General
-
Target
175d4647780ea64a02aaf60b08d6fb12ddc4b932049bea8763fcf34b6f039796
-
Size
363KB
-
MD5
4c147737c2ff4843291e4916ebc1704f
-
SHA1
d35dcbb1f7d2bc307da8ebacfee15efde0114c6d
-
SHA256
175d4647780ea64a02aaf60b08d6fb12ddc4b932049bea8763fcf34b6f039796
-
SHA512
277bd09ec7a763fbd1df567cae546fa0e8815f3c983da6405d7b8e2556c5cb92469cf7e0ded3b50e615ce25351ebf6eae37701613b5315fa3de35e8b74ee4747
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
175d4647780ea64a02aaf60b08d6fb12ddc4b932049bea8763fcf34b6f039796.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ