Behavioral task
behavioral1
Sample
e645a5a84d1a16914119f704e7bf71c44336821a1dc306d5c89d037f7c1aec85.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e645a5a84d1a16914119f704e7bf71c44336821a1dc306d5c89d037f7c1aec85.exe
Resource
win10v2004-20241007-en
General
-
Target
e645a5a84d1a16914119f704e7bf71c44336821a1dc306d5c89d037f7c1aec85
-
Size
128KB
-
MD5
eb9ff5335b70ec1fc97d9d1d5778b7fb
-
SHA1
b9abbb5fe37c328dc43f4b03ac9041a9e8766030
-
SHA256
e645a5a84d1a16914119f704e7bf71c44336821a1dc306d5c89d037f7c1aec85
-
SHA512
45dbb976e5e6d062ea9e24a7cf52f80e5f5add010a3240ae264bda37b92c8f3dfe509e37e565cc1d523682abccc401bb68db16e93d940324ae372f4eb56feda9
-
SSDEEP
1536:k002k+aQD9B9R60PGkHvPXm8w4jZSe4XxoC/hzKvibYNfcovR+8Lp:krQDz+wm8w4jZcXxoWGevqV
Malware Config
Extracted
redline
45.9.20.167:34189
-
auth_value
8cd9071c1cde5086bf9e52c4a65e22e0
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e645a5a84d1a16914119f704e7bf71c44336821a1dc306d5c89d037f7c1aec85
Files
-
e645a5a84d1a16914119f704e7bf71c44336821a1dc306d5c89d037f7c1aec85.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ