General
-
Target
7d5a873fac0accd3ab3e1ff59ffe9ef0c38c062792337e5ddabeef8713b2c20b
-
Size
361KB
-
MD5
2f2a394bdd46ce73ac5b2c02be10235a
-
SHA1
c595a8637381456db3875d85d84b1706ecf753ce
-
SHA256
7d5a873fac0accd3ab3e1ff59ffe9ef0c38c062792337e5ddabeef8713b2c20b
-
SHA512
76e9aeda019ffec5456a4c81f2de4b2ee579908559642c1ca8fd3e72bd588f72dbab86760e2bb1f83197bcdcb4c935c62845eae19b6ed43f2d15ccabb90153e3
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
7d5a873fac0accd3ab3e1ff59ffe9ef0c38c062792337e5ddabeef8713b2c20b.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ