Behavioral task
behavioral1
Sample
b90f904116403933251942864d79a96712911037ddbb1a7a0b4c855a2cbf8653.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
b90f904116403933251942864d79a96712911037ddbb1a7a0b4c855a2cbf8653.exe
Resource
win10v2004-20241007-en
General
-
Target
b90f904116403933251942864d79a96712911037ddbb1a7a0b4c855a2cbf8653
-
Size
169KB
-
MD5
d5d57cdfc580a14c859cc72824a2a470
-
SHA1
8cc6d7e7f22f5e7ea7be36b23e05d11dc38757b4
-
SHA256
b90f904116403933251942864d79a96712911037ddbb1a7a0b4c855a2cbf8653
-
SHA512
60833cd2fc0c93b8f4df2bedb56f903cb71221773c62a08a3cc3e2a22fadc83d1c17087c9d8ee132478104190ebdd10050f0673aee3ac4d206271d6aef23d08b
-
SSDEEP
1536:19FKuQhqlVZRGWWwZrC3T3AHHnpX9rQTGqVIbumugSeIsfcNm83wYk08e8hk:1jPQN93rUpXbqV4MoIsfcNmC8e8hk
Malware Config
Extracted
redline
dante
185.161.248.73:4164
-
auth_value
f4066af6b8a6f23125c8ee48288a3f90
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b90f904116403933251942864d79a96712911037ddbb1a7a0b4c855a2cbf8653
Files
-
b90f904116403933251942864d79a96712911037ddbb1a7a0b4c855a2cbf8653.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ