General
-
Target
37d973fc2f09977b1567657f6144848bcea73eea1a94c33ae8b2d36d34d05b8a
-
Size
362KB
-
MD5
a11f9a867364967585e4c431493c3d15
-
SHA1
1e9235dabfeab127cf7ceb27608b4c3b7d38ef00
-
SHA256
37d973fc2f09977b1567657f6144848bcea73eea1a94c33ae8b2d36d34d05b8a
-
SHA512
9b1a87b9a3814fdde75e3e0d6b5f99cb1518cc7fde8ad5342f776443cd9c680c69ba12f122c3a15b910eb3d5b0ed7f56056042cf7e92980aebb880692bf4826a
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
37d973fc2f09977b1567657f6144848bcea73eea1a94c33ae8b2d36d34d05b8a.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ