General
-
Target
218320e1cf479ee1c10d9b38a454e755fdbe0f8703b00884bb8a7575124d84ab
-
Size
364KB
-
MD5
b142d40934cc59d3b672dca207d8df87
-
SHA1
d802ca6706f6bd3212f66e382d86b4b9d0dbfe86
-
SHA256
218320e1cf479ee1c10d9b38a454e755fdbe0f8703b00884bb8a7575124d84ab
-
SHA512
ae9aef97000973e7ce4cb7c4650b7025d732787736e55cf9f44227ecfdf5b4077997206d90afddc7b7f8e3c00669c6a98ee64c9c5cdefc19ec84d291c87ade59
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
218320e1cf479ee1c10d9b38a454e755fdbe0f8703b00884bb8a7575124d84ab.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ