General
-
Target
3ab45d3b0e85504c38eb87cc82dcaecb0b8734e076987dc757354580a71ced2c
-
Size
363KB
-
MD5
1dc0de832014deb547d4b0a6b6e56f45
-
SHA1
2bb3f4809c96f52b1c5fb0550d3ecb688475e999
-
SHA256
3ab45d3b0e85504c38eb87cc82dcaecb0b8734e076987dc757354580a71ced2c
-
SHA512
20f5523ac616a9e5d6723372de5455112603a07261099e63e8d54fa2ad8a8239b5f60914bae4fc05264538cd6d90e1415cd1e78054b5134950bd96e664a76a51
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
3ab45d3b0e85504c38eb87cc82dcaecb0b8734e076987dc757354580a71ced2c.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ