General
-
Target
9f9c1676ef2cfdfa5dd892f1b0db6084613bac76828146cb8937837b0f397390
-
Size
364KB
-
MD5
2b4de19463a8dff53612faea090cafa0
-
SHA1
8ee16f1f07c551a7dfaa76da898e8fe4c3757038
-
SHA256
9f9c1676ef2cfdfa5dd892f1b0db6084613bac76828146cb8937837b0f397390
-
SHA512
79159653a8b568122facc2b3e4a3319f6ca50602bbbce475aa35178eb7668791ec87e20411c42ee6c8ae1778ae8d7c04340ca5c0dbd5ffcaa60d288fb0210817
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
9f9c1676ef2cfdfa5dd892f1b0db6084613bac76828146cb8937837b0f397390.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ