General
-
Target
9d66115164cbcd6751596d4ba09b56ed08f561e89817e58a6a2e4a878a811735
-
Size
364KB
-
MD5
b8c3d795ba1635f5fec90c8f22699a0f
-
SHA1
d6c9dbc5eecb639e9a0c8f696bd0352be86a8ae8
-
SHA256
9d66115164cbcd6751596d4ba09b56ed08f561e89817e58a6a2e4a878a811735
-
SHA512
04f46d453f8daf116e505741100fc4723868631435057c099f829369c245f15d583e7609bb0cf8508b3069a3480994b7ccc9b0c6dce5751e9c6af8d6b0b27bf8
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
9d66115164cbcd6751596d4ba09b56ed08f561e89817e58a6a2e4a878a811735.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ