General
-
Target
ee652aa694fca2c9cbc87d9679fa5ec00b85830771c4595ded5efd2ef0ab09b8
-
Size
364KB
-
MD5
acac872dd9afb83bb6a44be4054e8789
-
SHA1
6d9ff7e3de083cf1c01240fb8677527d673a7090
-
SHA256
ee652aa694fca2c9cbc87d9679fa5ec00b85830771c4595ded5efd2ef0ab09b8
-
SHA512
ed75959ddda095c3326b6c32323ead029644675192bc4c8bae42d0a7641261f3a8367f08b9db8f40022c1286dae755fe353bec16d9ec04ce718c1a574bc61e5a
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
ee652aa694fca2c9cbc87d9679fa5ec00b85830771c4595ded5efd2ef0ab09b8.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ