General
-
Target
b27cc283c88c6a15e580b1e7f0394bd2cfc4408a65275c46b52930233e145fba
-
Size
362KB
-
MD5
6f919dab440c485d7ab55f088592183f
-
SHA1
08c3ca0d2d616bdab6828793c3afb5c2a6d47bfc
-
SHA256
b27cc283c88c6a15e580b1e7f0394bd2cfc4408a65275c46b52930233e145fba
-
SHA512
7ffb730dbfef5d98db0a7794d9df9cfb600a432be240573103a249236c871069eca68fbd4275e5b38244df4430338e0211e7199e0e5e0d55579c7779e1cd6cac
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
b27cc283c88c6a15e580b1e7f0394bd2cfc4408a65275c46b52930233e145fba.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ