General
-
Target
c984942e8b3e28e183d8fcb0cbca9d7210c22ea27744719aa2aff541f718aeeb
-
Size
360KB
-
MD5
c7b5351ab4cbad4bc902a18b93f2bb72
-
SHA1
bbd00adaed12057a9c6c20376601201e00a34c04
-
SHA256
c984942e8b3e28e183d8fcb0cbca9d7210c22ea27744719aa2aff541f718aeeb
-
SHA512
86a95718dd71c854d0d6b6f13310e47584e91a5e568a1dbd7b7f62e78dad207f73a65e1711e7257e901534df6f7c833839d9ebddec497009bcea763c3c418cd8
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
c984942e8b3e28e183d8fcb0cbca9d7210c22ea27744719aa2aff541f718aeeb.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ