General
-
Target
abc2b5d2502f51060991866d5964259c0c35fbb8291abdee0a9a9e513e4e2c8c
-
Size
364KB
-
MD5
04de1aa925e765eeb44ad26614bc6676
-
SHA1
f394677007e7e956f91f53cce0a4e097d047d1ac
-
SHA256
abc2b5d2502f51060991866d5964259c0c35fbb8291abdee0a9a9e513e4e2c8c
-
SHA512
8d40dd6dc92c6f36c0182222db832ce04e87646dbf1c1c146fdfc6861c018022238fb681085216d268e940b0a7175a60ae7d2f6667fcf5c367425faaa565daa2
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
abc2b5d2502f51060991866d5964259c0c35fbb8291abdee0a9a9e513e4e2c8c.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ