General
-
Target
964d1ec82085349a5d1a6a5c8c53b3f11bd14ccc3da60f42e8f9339645e76a9b
-
Size
361KB
-
MD5
ba3d4d18dfc614e8a88d5f0d33c4cb97
-
SHA1
131fd718c4a59ca415db7bdd613f70972e3f3611
-
SHA256
964d1ec82085349a5d1a6a5c8c53b3f11bd14ccc3da60f42e8f9339645e76a9b
-
SHA512
1d45a6a777cface5fb95f57df4620b0a0ebf515047ca4d70ca94a3300b5de7903c66a5fcd22110b77085967f0d059f5ebce751136ae680e73287ed3422922247
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
964d1ec82085349a5d1a6a5c8c53b3f11bd14ccc3da60f42e8f9339645e76a9b.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ