General
-
Target
044cc6c0f0bfc96c2668e61fe6e44583fa0eff317bee8e587f081f071996a469
-
Size
361KB
-
MD5
57e05eda5ef4d659770a194f2ff2f765
-
SHA1
1b66ec5fda61c532435415e79db3b0c76957c76d
-
SHA256
044cc6c0f0bfc96c2668e61fe6e44583fa0eff317bee8e587f081f071996a469
-
SHA512
0c201b7310075aebaf2c11d936c08cf0f1a31b192d1dd33ced308bb68893c20e505e3fb822f6d114fc1b9f6d0e24b3d8841469153f6c927df74a2d97a139a531
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
044cc6c0f0bfc96c2668e61fe6e44583fa0eff317bee8e587f081f071996a469.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ