General
-
Target
7469c56d341047cfc124848adb7efdfe276e2188370dd022dfed8e2326de3363
-
Size
361KB
-
MD5
df7c61e485528620f8a128d74b8ac0cb
-
SHA1
8a1f6b44a3508dabc71a02915dd23cfc187073c7
-
SHA256
7469c56d341047cfc124848adb7efdfe276e2188370dd022dfed8e2326de3363
-
SHA512
0a4e2ab3c3bd1b522aa8d7802c1e9a947b324956fb9322146d3da883e6b5ec86d0a530fe1e6194a9e00c0d6535f2792433c52d8524cf8ef9fc81ccc30750d848
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
7469c56d341047cfc124848adb7efdfe276e2188370dd022dfed8e2326de3363.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ