Behavioral task
behavioral1
Sample
ea7fdf3481351ec37052dfce65cd36ca157336089eecd4135584684acb2f9485N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea7fdf3481351ec37052dfce65cd36ca157336089eecd4135584684acb2f9485N.exe
Resource
win10v2004-20241007-en
General
-
Target
ea7fdf3481351ec37052dfce65cd36ca157336089eecd4135584684acb2f9485N.exe
-
Size
145KB
-
MD5
dbc41295c1cd315fb87b3486d2ede270
-
SHA1
6f7af86113f923da006809c2590c0006bcafc803
-
SHA256
ea7fdf3481351ec37052dfce65cd36ca157336089eecd4135584684acb2f9485
-
SHA512
be9818ecca9f773d874ad0bf93498ecb9f779811f05c88ffded431ce5c8cd4399fffd81ae1a958cfc97989e20135727a583498c33403c1235c7e28e446b0e457
-
SSDEEP
3072:nV+m5czQmRS9I6E24dl3CZz3FhRZG8e8hT:njKmE2WcTFhR8
Malware Config
Extracted
redline
masta
185.161.248.75:4132
-
auth_value
57f23b6b74d0f680c5a0c8ac9f52bd75
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea7fdf3481351ec37052dfce65cd36ca157336089eecd4135584684acb2f9485N.exe
Files
-
ea7fdf3481351ec37052dfce65cd36ca157336089eecd4135584684acb2f9485N.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ