General
-
Target
e3cae3554e18b0e97cd5178ef2808d87759505eaa91ad33ad5f75a45b96c511a
-
Size
360KB
-
MD5
48fc21c320d4f2a1f3dce7fe41545451
-
SHA1
364a4f091ab5debac7278ce75dd84483e27859dd
-
SHA256
e3cae3554e18b0e97cd5178ef2808d87759505eaa91ad33ad5f75a45b96c511a
-
SHA512
fb4c41ed5f24a4ceec691724ffb072851f7ed08303636bee277610982b6b6f13c33925909c3ff6d6e4e27b718817d2aeded08101eb1dd3479b4e2b4eed771cff
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
e3cae3554e18b0e97cd5178ef2808d87759505eaa91ad33ad5f75a45b96c511a.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ