General
-
Target
33ffcf0a5467824e5b10c973c46f3b63a1bff49750f52fc126e90a3a3df84994
-
Size
364KB
-
MD5
fe6e868bc8759ac6ed1ce2449458bccf
-
SHA1
bce9185195605636caf73c3de0c8bd427c692694
-
SHA256
33ffcf0a5467824e5b10c973c46f3b63a1bff49750f52fc126e90a3a3df84994
-
SHA512
e4ad0561701e0623a36dd82baea575c51b62103edef9dadf7419c71262c753b8f636209b5f472f43c6680218ae8a261ddfa48d5f76b47ae7b3e8f44f56232b27
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
33ffcf0a5467824e5b10c973c46f3b63a1bff49750f52fc126e90a3a3df84994.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ