General
-
Target
483e72961cdf9d3d96c34e65897fd68194c45ed441dd2c09d936182031d19236
-
Size
360KB
-
MD5
2deeceec48d75f2e73d175324b52be32
-
SHA1
4f683a727a0400949cc193fec5fc8a8319803fc1
-
SHA256
483e72961cdf9d3d96c34e65897fd68194c45ed441dd2c09d936182031d19236
-
SHA512
43e24d5e551ab4a16148977b76082ae264ecbaa2cd577505b89963c39d42a9ef70df0ac55c4ed2c17be2de423e62b887c4344a3ee027c2760e53ca6ad3d8b77d
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
483e72961cdf9d3d96c34e65897fd68194c45ed441dd2c09d936182031d19236.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ