General
-
Target
044808206b15c3f6e76d7607021c374d0fa9e133827385c1dfc6b7e7ae546381
-
Size
364KB
-
MD5
96a78796fdd39d809a78fb05829ff763
-
SHA1
9ebb001120623104748a010573e1ebc2eabeea7a
-
SHA256
044808206b15c3f6e76d7607021c374d0fa9e133827385c1dfc6b7e7ae546381
-
SHA512
8249e8c81a8706d39427cb0f7c8504e6531417e2e7b84b11fa6180122e879e62cb7fb2e33452af49ea57a11eba9beb82f578ee8f873b2b4178cd405db72d8dc1
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
044808206b15c3f6e76d7607021c374d0fa9e133827385c1dfc6b7e7ae546381.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ