General
-
Target
388aa5de5a0a4cc0fb48578d4ac05cc7c47114b493d84389e449312a2014bf2d
-
Size
361KB
-
MD5
9cdff50f94a6faaca0bf961a0e6b3ec3
-
SHA1
63ccbf9aa019d9b2f6b21b3249d242882e254425
-
SHA256
388aa5de5a0a4cc0fb48578d4ac05cc7c47114b493d84389e449312a2014bf2d
-
SHA512
67010aec8a2c64e927792e09eb443689ed4bdc7fcfe14b2b0c736a72f7fda34112e2b72d448637353221f51549eb7fc00d66d7b365932607dc2972dcf35cd521
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
388aa5de5a0a4cc0fb48578d4ac05cc7c47114b493d84389e449312a2014bf2d.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ