General
-
Target
75b71ac533f16575dd5d2084857b4522334f6e3303802e88e7cbed1e948653ff
-
Size
362KB
-
MD5
0b376bb1345001d920e23d5b627e9ffe
-
SHA1
61425216dbdb4399ee5b3fadd6bc6199d51e51cc
-
SHA256
75b71ac533f16575dd5d2084857b4522334f6e3303802e88e7cbed1e948653ff
-
SHA512
d462e0fdb3dfa058fd94dfbc84e7e638271665e2e9af3814f86870f7199479cf5c27890e00e3c703f2b6cf4033251e37e5ac7dfc969b26ea0fa811fa8b633524
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
75b71ac533f16575dd5d2084857b4522334f6e3303802e88e7cbed1e948653ff.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ