General
-
Target
4c73de8bc4639d91600c07f422969e2b5a205dddeb69d0d5539ae4559b596363
-
Size
363KB
-
MD5
92c7fb0adbfd3f4f38b69c883bce74d3
-
SHA1
863d0a04b4e115da679e276c268e28a13aa6e352
-
SHA256
4c73de8bc4639d91600c07f422969e2b5a205dddeb69d0d5539ae4559b596363
-
SHA512
e758cffa1390413a8469f124b0bd64108b552d369f549597a93a81d3b48619f04bccd3fcc7ca78aba1c854829b2d970af16a67b1c3ece5367d2ab48a11cdd4c0
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
4c73de8bc4639d91600c07f422969e2b5a205dddeb69d0d5539ae4559b596363.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ