General
-
Target
413eb8ad722ea47634dea0cc9c2c91b759104e79ea6f0d218515a5e4c02b231e
-
Size
362KB
-
MD5
b42136eaf76febcb3ee9e1bb9d455715
-
SHA1
1616b44aed325fa85a06e5c5fb7cdd1d7583ead9
-
SHA256
413eb8ad722ea47634dea0cc9c2c91b759104e79ea6f0d218515a5e4c02b231e
-
SHA512
cd62701e95e4f7687e479e35718ee55d19b3c4088d934eac50b52228eee1b0e7f65d178e6045bd3eca7444c2ba140b8af93fceaf300f89091ef0165cef0ebd81
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
413eb8ad722ea47634dea0cc9c2c91b759104e79ea6f0d218515a5e4c02b231e.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ