General
-
Target
b4d5e93a4a28607b1a8df374e0458bbfb846ee7eaa818f884a48311f7dffdcfd
-
Size
364KB
-
MD5
1d6c57bbda5ebe527c081b050b4143ae
-
SHA1
a06bcd11e1884702c833093ec878294ad09ed22d
-
SHA256
b4d5e93a4a28607b1a8df374e0458bbfb846ee7eaa818f884a48311f7dffdcfd
-
SHA512
eac7750e393bbf97932aa781fd41721ba80f1917c70fce33c9020ea03f28c4594b15caed9c7d6dd5611656cf1e10d9cd980aa01864d531ac8c3546832f9ea70f
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
b4d5e93a4a28607b1a8df374e0458bbfb846ee7eaa818f884a48311f7dffdcfd.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ