General
-
Target
51788edaad976c76a35874cf1ad13d09494e4fd91842f4615dce58e10de4b8f2
-
Size
364KB
-
MD5
c40aca74015fda5d319ffe37f895b023
-
SHA1
bc43cc6d3f2da63102c43fa726d2e5719fcf7beb
-
SHA256
51788edaad976c76a35874cf1ad13d09494e4fd91842f4615dce58e10de4b8f2
-
SHA512
5f799580ad654213aa7d6b9dcc322751ad7794e23461a7d70a09b4226532b395db705e1f4c8f159914e037b132d417ca7e34b92e225f0394aee026a7fbde7f11
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
51788edaad976c76a35874cf1ad13d09494e4fd91842f4615dce58e10de4b8f2.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ