General
-
Target
9d750d1d17695aa434a5aa4483e77ec48cf4da38acf67c49281c296992f85c05
-
Size
364KB
-
MD5
a374c9e6d54dfc92dcc0e998637cf113
-
SHA1
04ed36343fc3d19a78e865015b4b4608dd9436b0
-
SHA256
9d750d1d17695aa434a5aa4483e77ec48cf4da38acf67c49281c296992f85c05
-
SHA512
9158f81d376d7099d037f9e0c3f1c974bfe381e553147dfe1382a115422661ae1e879d4c873011843f9878d7f40d24cf5b00257a6a5f0b55e93739c72a73be3a
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
9d750d1d17695aa434a5aa4483e77ec48cf4da38acf67c49281c296992f85c05.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ