General
-
Target
e7806a8de59ee5fe3e92e1a8eb84e78dae3f5b4f62695e4a1f7c79d15d02cf8e
-
Size
360KB
-
MD5
b3f62279068e7a49794279bb46513725
-
SHA1
0e691c400f1b8d3d5b848f714670c8e435349843
-
SHA256
e7806a8de59ee5fe3e92e1a8eb84e78dae3f5b4f62695e4a1f7c79d15d02cf8e
-
SHA512
deae6051c0614250d0dc928494d25eea92e5465417ec1147d3d4ed1f85cd5957d955b22490a318938d071346b2658955fc1e8624b402153c851d1c38a6edae76
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
e7806a8de59ee5fe3e92e1a8eb84e78dae3f5b4f62695e4a1f7c79d15d02cf8e.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ