General
-
Target
3043335b7a7b43814c181e8039ca3beacfe9bf7bca5be17064d2f214a5bb1baa
-
Size
363KB
-
MD5
7b851f7bb1243f1d9fcc64e6ef81defe
-
SHA1
2b9360c5469ee5c6e747fea6c709820ff0a821d5
-
SHA256
3043335b7a7b43814c181e8039ca3beacfe9bf7bca5be17064d2f214a5bb1baa
-
SHA512
151fe3211abbb28069b952c43f4ddcb59de91ea43a8cfc9e04caf1036cf102d82ff518bcfa78005d73b8893e446c3bfd4e9d271068f0de49f1bf0557c0ecd896
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
3043335b7a7b43814c181e8039ca3beacfe9bf7bca5be17064d2f214a5bb1baa.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ