General
-
Target
0701b3c7bb26074cced5b435fddc8f8c000c38a50fcc684c2eb861798a2c42d7
-
Size
364KB
-
MD5
97c74d6c44d33ec12aab87c7bbf8ffe0
-
SHA1
3282a4234390ec8cfaa26e422ac56a4eb43c0b7d
-
SHA256
0701b3c7bb26074cced5b435fddc8f8c000c38a50fcc684c2eb861798a2c42d7
-
SHA512
822c9e47f450359188c9bda763dc266d7cf3a7993d91f065305b26890856b2796bb2d022d75c056853dcdd870ece723ba5048f3c2e12b3829f5d0173b8b47445
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
0701b3c7bb26074cced5b435fddc8f8c000c38a50fcc684c2eb861798a2c42d7.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ