General
-
Target
b63038d0aef775b1d81aec4929959a175f297e631a3fc93fd2bb14efacbb4381
-
Size
362KB
-
MD5
1d9ee5a910fb9efa58e54da3c293f69b
-
SHA1
2a845dae6360b6021af1cf81a45822cf20ef3867
-
SHA256
b63038d0aef775b1d81aec4929959a175f297e631a3fc93fd2bb14efacbb4381
-
SHA512
c8b042e5e2f196a4bca75cfe496ca78410d2e09f5be0d601c266af003493124fa6b242b68c60d72ad8c3218b850ab807812ae47dc7d2b2879db541bed772b522
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
b63038d0aef775b1d81aec4929959a175f297e631a3fc93fd2bb14efacbb4381.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ