General
-
Target
dab9d78d65c559e1b97fee3b78da40c42079a71b8486914478690ea8d588ac44
-
Size
360KB
-
MD5
7bdbe62117fce890bc3c4c6ff9ef70f1
-
SHA1
043810410ac16f4734cf80eacf23c61abf8bba30
-
SHA256
dab9d78d65c559e1b97fee3b78da40c42079a71b8486914478690ea8d588ac44
-
SHA512
d8910a80881d49e084e0f685882837589bb4d36067a7b29f06600cf44059bda773d3a7802cd544c0a46cf8949a3b6295c2925c1c22bd7ee7abe5a297cff63bd1
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
dab9d78d65c559e1b97fee3b78da40c42079a71b8486914478690ea8d588ac44.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ