General
-
Target
701f456fd720fa9c00574ad5863710bd27d49f30cf4c2d71c422b4605e5eeb99
-
Size
361KB
-
MD5
a85c1878d66f503576d4fc85ec7faa1e
-
SHA1
0f29cadf60585407bfbae2661840c1547c4ef86b
-
SHA256
701f456fd720fa9c00574ad5863710bd27d49f30cf4c2d71c422b4605e5eeb99
-
SHA512
c1ce8dd2bc52ac49db8f6d7e1fce28baa31cf7dc41d566f72008e9bd651496bbbaab9e1b3c95f2505857f4d5bef229d5e06e983e6ad0749723cbd73890346eb7
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
701f456fd720fa9c00574ad5863710bd27d49f30cf4c2d71c422b4605e5eeb99.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ