General
-
Target
e5acff707fee79bf759c22d2e9c37eeb466e9cff94981862694d67f0b03dccb5
-
Size
361KB
-
MD5
a3f53be11eb6876c3e0f649a42a4f9b7
-
SHA1
f0195222e695601124ce237f031ea27f14ecd9f5
-
SHA256
e5acff707fee79bf759c22d2e9c37eeb466e9cff94981862694d67f0b03dccb5
-
SHA512
a288f96054976c528907c3a32ececb81022bd15c5abc8635e804aa303ae7c32c16ea7ecd1e364634ac678358a4a5b3efbc2dbbb6dfbd14623cb31caefe26566e
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
e5acff707fee79bf759c22d2e9c37eeb466e9cff94981862694d67f0b03dccb5.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ