Behavioral task
behavioral1
Sample
3b5eeed395e55b307e7d51a806b3310ec5f692e8c2751d3bbc85dd6cbcb374c6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3b5eeed395e55b307e7d51a806b3310ec5f692e8c2751d3bbc85dd6cbcb374c6.exe
Resource
win10v2004-20241007-en
General
-
Target
73ad3580e4900188185a5ac2ec94b2aee579769c4939282ae6557bf3c7959710
-
Size
59KB
-
MD5
c86199a5134328f0134ce421baa492c2
-
SHA1
9988b07bdaa6030214a902e799c430a0fffe2e46
-
SHA256
73ad3580e4900188185a5ac2ec94b2aee579769c4939282ae6557bf3c7959710
-
SHA512
54a9e85733c50526a92382d5c6de761149dfd40a467d9d9d92220b521d950644d6bdfc82a9e65bb7b81d6200805d1c24f866f62f131aad8aecc848361ece094c
-
SSDEEP
1536:BIXOjoV3tHS/E0J2c3ORy6OsdKfNuCg9F1Yuz:cOjCHS/E0j3Ooxlfovj
Malware Config
Extracted
redline
already
192.3.110.135:22314
-
auth_value
ded20299ff3483261f66fc9e17a8056f
Signatures
-
RedLine payload 1 IoCs
resource yara_rule static1/unpack001/3b5eeed395e55b307e7d51a806b3310ec5f692e8c2751d3bbc85dd6cbcb374c6 family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/3b5eeed395e55b307e7d51a806b3310ec5f692e8c2751d3bbc85dd6cbcb374c6
Files
-
73ad3580e4900188185a5ac2ec94b2aee579769c4939282ae6557bf3c7959710.zip
-
3b5eeed395e55b307e7d51a806b3310ec5f692e8c2751d3bbc85dd6cbcb374c6.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ