Behavioral task
behavioral1
Sample
89c073544413c613d25eb0a344f474fc9674990e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
89c073544413c613d25eb0a344f474fc9674990e.exe
Resource
win10v2004-20241007-en
General
-
Target
89c073544413c613d25eb0a344f474fc9674990e
-
Size
120KB
-
MD5
9ca3ad6887a012ca339cac5fed2ff7cf
-
SHA1
89c073544413c613d25eb0a344f474fc9674990e
-
SHA256
7df8028f4ea9b93ff67e3d36059f1b184d61c67ad9ed46715349153ff9609eab
-
SHA512
0aab1226800f6a8f44d4a3f9a702733001a658cdea77746a05410bac1532072d7abbd1a906b8f870d770718881c07d0407e066f16ec03190610bcec20bf3ebd7
-
SSDEEP
1536:Bqs+FRcqWClbG6jejoigI743Ywzi0Zb78ivombfexv0ujXyyed2ztmulgS6pUl:veRclyY7+zi0ZbYe1g0ujyzdrU
Malware Config
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
-
SectopRAT payload 1 IoCs
Processes:
resource yara_rule sample family_sectoprat -
Sectoprat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 89c073544413c613d25eb0a344f474fc9674990e
Files
-
89c073544413c613d25eb0a344f474fc9674990e.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ