General
-
Target
a0376d8be58387a0bc497e823e28b4548b48e9ebbde63a5a342e0f7adc497606
-
Size
361KB
-
MD5
a37454ac504c6ae2b54d32fc9edb46ff
-
SHA1
906c94822335f41643a6de01666f192f2237a85b
-
SHA256
a0376d8be58387a0bc497e823e28b4548b48e9ebbde63a5a342e0f7adc497606
-
SHA512
3c7f9ab6f338d72ab06432a4626fb8a171b920cf0da952bdd58a0fd761c5b59a8d7b3cef4af40327bbca9d344a693ed1c3b0b150fe08b116a68d5cb503d79509
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
a0376d8be58387a0bc497e823e28b4548b48e9ebbde63a5a342e0f7adc497606.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ