Behavioral task
behavioral1
Sample
Aer0 Spoofer - Stable .exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Aer0 Spoofer - Stable .exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
Aer0 Spoofer - Stable .exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
Aer0 Spoofer - Stable .exe
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral5
Sample
Aer0 Spoofer - Stable .exe
Resource
win11-20241007-en
General
-
Target
Aer0 Spoofer - Stable .exe
-
Size
104KB
-
MD5
c590e3a406fd59d4a8c7f1ce53405931
-
SHA1
2a8b989f264ea650ca8ddf3287c65ca86ae274a0
-
SHA256
88005be6c7e541d6933b6dfdf8cbfc318df08ba13caf16bc4dd46e87edb09b37
-
SHA512
2c3f9855919a069da043e843dc85d603c1df672923026d1a53138f060314c5e9fbd10d79bccc6663bd29bfc924d93659e42b61c19691692eb5ddb61639278df2
-
SSDEEP
3072:1OZk6sAbLjlp5q8uE0/PyOk7mfnPVeIJvwj7:1NwbLjlp5q8udy6VOX
Malware Config
Extracted
redline
@Yuki4onna
188.124.37.219:26360
-
auth_value
a797101ee49e671712f69e8c73bded51
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
Aer0 Spoofer - Stable .exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
1b:46:0a:e6:ff:6f:33:9c:40:8e:cb:34:b9:50:12:10Certificate
IssuerCN=Subsidizes,O=Runniest Morrised Inc.,C=LT,1.2.840.113549.1.9.1=#0c1b706f6e65726f6c6f6779756e696465616c40676d61696c2e636f6dNot Before23-10-2021 21:00Not After30-10-2031 21:00SubjectCN=Subsidizes,O=Runniest Morrised Inc.,C=LT,1.2.840.113549.1.9.1=#0c1b706f6e65726f6c6f6779756e696465616c40676d61696c2e636f6dab:bf:3e:3b:97:8d:34:a6:0b:45:0b:f1:e6:d1:10:ff:a8:92:f1:9eSigner
Actual PE Digestab:bf:3e:3b:97:8d:34:a6:0b:45:0b:f1:e6:d1:10:ff:a8:92:f1:9eDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ