General
-
Target
a2cdcdabd25fbcaa6a6a95d375dcaacde89c03709cb13f4f04f5c9f274623d6b
-
Size
363KB
-
MD5
8943808df12600f1b3d954e8e9606cc7
-
SHA1
28f022dcf0bc36dd74257717c293b7faad681c59
-
SHA256
a2cdcdabd25fbcaa6a6a95d375dcaacde89c03709cb13f4f04f5c9f274623d6b
-
SHA512
62384d2e2e775289980c23a6c36eebe7ac69bee416047cfcb47e7b96733e0ec9d86e16533eda70d12f2e1e038c9c91807df5dac8d38718de1a499ea30e358f27
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
a2cdcdabd25fbcaa6a6a95d375dcaacde89c03709cb13f4f04f5c9f274623d6b.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ