Behavioral task
behavioral1
Sample
576e958d34a6d11cc761fd84c1f05268ce8fdbaebe045151afaa2c03a5138531N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
576e958d34a6d11cc761fd84c1f05268ce8fdbaebe045151afaa2c03a5138531N.exe
Resource
win10v2004-20241007-en
General
-
Target
576e958d34a6d11cc761fd84c1f05268ce8fdbaebe045151afaa2c03a5138531N.exe
-
Size
136KB
-
MD5
675a13f802168cd60a1335c5fdb68d50
-
SHA1
8a7f725bfa146b1fcc83359a8addd8b3f3a8bcf5
-
SHA256
576e958d34a6d11cc761fd84c1f05268ce8fdbaebe045151afaa2c03a5138531
-
SHA512
eaba677161f22701811aa74f880756ad22960ed49906a21e460afeaa73b9e6588f31129a8d8a4a4c113fdf740fdbaf53fae899023ccfcd3ea03aeb4a5cf4d550
-
SSDEEP
1536:BMi4rQ8qOCqm36k0BXlObJt6fh4C5hbV/hN0sA9sYgibfbFDKsRj:OxrQ8qOTF8d64GJd/0sAyYgafJlj
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 576e958d34a6d11cc761fd84c1f05268ce8fdbaebe045151afaa2c03a5138531N.exe
Files
-
576e958d34a6d11cc761fd84c1f05268ce8fdbaebe045151afaa2c03a5138531N.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ