General
-
Target
6d150d3bcf8d5eae991e897ad1aae32d36be293a09468ea6d049ed2861c6aa28
-
Size
363KB
-
MD5
76a8859f5e3edb9e268a632d80096d9d
-
SHA1
8d7cbd6a490ff693b56cdb3cf81f24677dee8518
-
SHA256
6d150d3bcf8d5eae991e897ad1aae32d36be293a09468ea6d049ed2861c6aa28
-
SHA512
d4b262eb544ad1e8dbf798ca2d1fda149858b000a35cfeeae20be752626fb4aeb343283fe62be920a363d0fbede63376b3c602d2a7a11987f60729f247533f84
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
6d150d3bcf8d5eae991e897ad1aae32d36be293a09468ea6d049ed2861c6aa28.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ