General
-
Target
9fb2ea0e147b9bce57d1e5ef9d01726f8f5d53d3c1c72065618f9536966a7138
-
Size
362KB
-
MD5
638daf676dbde85bca2542eac8d82d85
-
SHA1
64c90e730d27683e776418e05f05066dda61ed91
-
SHA256
9fb2ea0e147b9bce57d1e5ef9d01726f8f5d53d3c1c72065618f9536966a7138
-
SHA512
3dd2cf1b4764afce4bc7f31c4672b078aea68a2b391b93db7a53d08fe1fb31e534c1f017e3926b3d712f4b1be796517e764708dfd8ab675a2b03806f1c5f173c
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
9fb2ea0e147b9bce57d1e5ef9d01726f8f5d53d3c1c72065618f9536966a7138.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ