General
-
Target
98bfdb85b8deb452cd66984cef7fd2258155f970b0dca9e7e4840a232fc581dc
-
Size
361KB
-
MD5
b295d61f35b0cce2b9674fcfec8e5efa
-
SHA1
4cb0f15a6e1e776c40f8b64f1df07e867be3aa90
-
SHA256
98bfdb85b8deb452cd66984cef7fd2258155f970b0dca9e7e4840a232fc581dc
-
SHA512
787a263fcc27ed2dbdb96a45a48029a939b0ced136bbfe32d6504f00c54754e4fb56b04787427803a434c216ee282627f32be8656d8a19250af0ebb683c982c0
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
98bfdb85b8deb452cd66984cef7fd2258155f970b0dca9e7e4840a232fc581dc.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ