General
-
Target
cbd90a3f7db52f0f4c9bc59518fe79b8cc7085a5b6a14331b52e877ed97dfc2e
-
Size
362KB
-
MD5
7a1ad3641d0be03d5cc5b179bbf3a05e
-
SHA1
2039976af2717a95dbc480ffd30da3d070b027df
-
SHA256
cbd90a3f7db52f0f4c9bc59518fe79b8cc7085a5b6a14331b52e877ed97dfc2e
-
SHA512
c6a6f39f0ebb81c6b05c6bda60c92a09679cd51117b4942d6039e33588a2e67352dccb33f630d7a753e8f84cd7f87a707735e0fd84e352724fefea5e8790293c
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
cbd90a3f7db52f0f4c9bc59518fe79b8cc7085a5b6a14331b52e877ed97dfc2e.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ