General
-
Target
78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466
-
Size
360KB
-
MD5
229f45ca9b43dc158b48ef4fe7c5b22a
-
SHA1
1b54f317c29b894ecc74ad6a5c93a81fa4cbd298
-
SHA256
78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466
-
SHA512
e626f1532a08e038ade371b710ab98f5e528b668c8641a6d1836c7cfadfb0cff8ad6ae83f0367e76768d98ec00fe432ccb81d35f2da37bd5661e3f9c4cb65520
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ