General
-
Target
21cccea4d26eed4cf517cdbf4db6ec2fba2c0d538e5930ad0b15f8603183444c
-
Size
360KB
-
MD5
7c18eb2c2df156b2aa2a84e249743a2e
-
SHA1
68b2387df980477773dbb8fc41701b6e1534b04a
-
SHA256
21cccea4d26eed4cf517cdbf4db6ec2fba2c0d538e5930ad0b15f8603183444c
-
SHA512
c0cb3e666c72b098037801d671c6337f1f2af3e4a17451dcbce7ce15991f8afeb75493c65cca93ed4cd42dea83ddfbbcee4b1749e1bb110ed1cecf39da94b1d5
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
21cccea4d26eed4cf517cdbf4db6ec2fba2c0d538e5930ad0b15f8603183444c.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ