General
-
Target
39abf7af61ca0dad4a3c2d5045f36aef7df9d1770b40a217cde8eaff2849fea8
-
Size
362KB
-
MD5
40347c4c489228c0e11d64fcc8b2a57b
-
SHA1
ad10476e38e3e41206fa62a22e1da20ca4060c95
-
SHA256
39abf7af61ca0dad4a3c2d5045f36aef7df9d1770b40a217cde8eaff2849fea8
-
SHA512
1e3633f04c8c8f5e65f38d36360ce1d1db88e703798d56b6c911c695d327e27a037873f647a8fa51928c962bbea42592622d80ecb7e65f7479588da35ff3d328
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
39abf7af61ca0dad4a3c2d5045f36aef7df9d1770b40a217cde8eaff2849fea8.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ