General
-
Target
653afa920eb9485907dc819d19d4801e749db0b0a90d6a450963469ab8014808
-
Size
364KB
-
MD5
9e4eeb99cd6ae36efabe5a1a84e2d936
-
SHA1
22f457410a6df89ac0309b60c5e0b3a0002fcc32
-
SHA256
653afa920eb9485907dc819d19d4801e749db0b0a90d6a450963469ab8014808
-
SHA512
e8891fc0e810e9c6f3211f535188ac73034e92ef20b7196b9ca2bca7189488d2b06c7efa06eacdeae19e73573d05e4658f2f8fc1f0fddc2eaeeaa2aea365cfba
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
653afa920eb9485907dc819d19d4801e749db0b0a90d6a450963469ab8014808.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ