General
-
Target
d916beab613ca905f5c1dda6802974aa2e37cae8c49a92a7700c04c8a809bba0
-
Size
362KB
-
MD5
8dbf22eee5619725f40568490bbdf76d
-
SHA1
d394d1196b6c62a5dd7954da271415fc390aef33
-
SHA256
d916beab613ca905f5c1dda6802974aa2e37cae8c49a92a7700c04c8a809bba0
-
SHA512
01bd42c6935c081ac49d00c2e231582e3121ab67eb9eb4756b940902e627e8d6b8d08d462f0bec6c33466eb45e4eb0c09b53706961076e9b0f9a9f931e0395a7
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
d916beab613ca905f5c1dda6802974aa2e37cae8c49a92a7700c04c8a809bba0.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ