General
-
Target
8b34c84fb4637ecd8ff2ef61b6a5bb7f9b220a3334ac2fcf556283fb6349cb95
-
Size
361KB
-
MD5
fc25cc55417852e02f3d9422c4cd80fe
-
SHA1
bc5d2c3ea13d534897676e44fb4f19d22f3d39e9
-
SHA256
8b34c84fb4637ecd8ff2ef61b6a5bb7f9b220a3334ac2fcf556283fb6349cb95
-
SHA512
7e8bb159d943c23ff158afe46fb0a21a8216583129469324b6c27815a501598ef32f7cf22d19ecd61b3a8e9df9f9591d9fd223b973dd2258c9d224f87f850fcb
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
8b34c84fb4637ecd8ff2ef61b6a5bb7f9b220a3334ac2fcf556283fb6349cb95.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ