General
-
Target
83befa755c5003cb5cc914ba58b13d6e2914aef07ef1af10eb4c934310e6e95a
-
Size
363KB
-
MD5
c4f7cdaa0237a336bd4e1b698a81de42
-
SHA1
c6959bb650a9e47940c8386a4c52c99b99e19583
-
SHA256
83befa755c5003cb5cc914ba58b13d6e2914aef07ef1af10eb4c934310e6e95a
-
SHA512
3b77983fdef452bca9ef28263139651ce5203e32d2c636fe6f7e535bbb54463d3b407dd46b7dad3c007910223db0e2dc2677ec188dbb89f40b498aee576c19ee
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
83befa755c5003cb5cc914ba58b13d6e2914aef07ef1af10eb4c934310e6e95a.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ