General
-
Target
77cda17035d8a58c8205397c529ae3a13be94c09b140121d87ea1b3ab1cc5de2
-
Size
363KB
-
MD5
8975bfd2f3fff74897136fade4374c07
-
SHA1
9111fad822647581d2b0cfdb78c4b5f78e7d4174
-
SHA256
77cda17035d8a58c8205397c529ae3a13be94c09b140121d87ea1b3ab1cc5de2
-
SHA512
df563bed5ab94f293ccc0a3e123fd7a8cb965ea709a7af5e6f188d4877f730cbb5dc74e23ab9ea2b560eb9f5d1a65b6525b05bce3b29c1f535f6ec9a9f827911
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
77cda17035d8a58c8205397c529ae3a13be94c09b140121d87ea1b3ab1cc5de2.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ