General
-
Target
ac51317b86a09e58f986ce3286228df3ad825ffa8ee4f16593bff3028e0996c6
-
Size
360KB
-
MD5
7c3371e41acce68932aa7f3a9529aa77
-
SHA1
677596c40c89b6e9fbf43e6d2fc05f91658303cf
-
SHA256
ac51317b86a09e58f986ce3286228df3ad825ffa8ee4f16593bff3028e0996c6
-
SHA512
7c51605afc15fc4719c38abea02de4544ecc068663318e09c324c21d8f111e55ef88f137fc8588164e3c2c10c78c02eb8fa306cb989abf2ad3c50ef65655e411
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
ac51317b86a09e58f986ce3286228df3ad825ffa8ee4f16593bff3028e0996c6.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ