General
-
Target
c55894bd8ffcd3c4081f097c1c61fb68fcb59eae9a0804c27d549e82f4d2fb28
-
Size
364KB
-
MD5
a78456b040032ce7beaf0fd40e0e168f
-
SHA1
00d9b51e8e47a8848598fd83f10164c0c365a4e7
-
SHA256
c55894bd8ffcd3c4081f097c1c61fb68fcb59eae9a0804c27d549e82f4d2fb28
-
SHA512
60702c1d749ebb29fe81c82f8fe436f6606115e11d22f3a00d25ef131d330e065eeb76b0243dc2cfc2a5612ed4ae8fc2ca008700140ba52b72ee194cff28481d
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
c55894bd8ffcd3c4081f097c1c61fb68fcb59eae9a0804c27d549e82f4d2fb28.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ