General
-
Target
13c8af0a4969443cf812687d5bf3d98963c11edf713f1ee698bbf8886b96b5ad
-
Size
361KB
-
MD5
9fa98f069795433748d5e1caf6f767b7
-
SHA1
1aa7021326778c9794958f50c3248792897bf4f4
-
SHA256
13c8af0a4969443cf812687d5bf3d98963c11edf713f1ee698bbf8886b96b5ad
-
SHA512
fc273588297d85bdf1c022b25f18b223a779f720289f0a30dca6817e4cc2f89e5b97b5e2270527fe0271a03aa5fd1042d19a389f52c1b494509537134c53844d
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
13c8af0a4969443cf812687d5bf3d98963c11edf713f1ee698bbf8886b96b5ad.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ