General
-
Target
4f31ab832d10e019b4b9db43089eed4f5c2ddd10aba6a14940c24887e6e045dc
-
Size
362KB
-
MD5
cb126056a49a2d8186656a57032335ec
-
SHA1
ac74cf2eae9d9b9760b1d8d96c950081c16dde03
-
SHA256
4f31ab832d10e019b4b9db43089eed4f5c2ddd10aba6a14940c24887e6e045dc
-
SHA512
e8aa325f6996a6a613ca1117d2b9f18843018d66e8a70f1d6c04fddda7a50b1f24b9bea78a8deb5274405c3dab5b8cc1750be4d9b029911fb24122bac8638a66
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
4f31ab832d10e019b4b9db43089eed4f5c2ddd10aba6a14940c24887e6e045dc.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ