General
-
Target
54869cbab7c7f0273dd9b6aaa1ea0f6e029348909b40fa48b721bc1fa49f7f51
-
Size
137KB
-
MD5
5e6ba3cf4b679c1f19b8f0399b6df5ed
-
SHA1
33b62204a83c07d1b16b2dbb80e9e72694b6b990
-
SHA256
54869cbab7c7f0273dd9b6aaa1ea0f6e029348909b40fa48b721bc1fa49f7f51
-
SHA512
7e7bf4d9cfdffca82a06579cc531e88eda326ce6c051081c9dcc78e5ea5ee993ad1135e90f623fe0a1d02cf91835e18a476e4554fc76c537cf5eeeefb034ae7e
-
SSDEEP
3072:JYO/ZMTFtJjcZ7GFn/gQeJGV4HDFPyRXehsSSwz:JYMZMBtJjcUxoQqQBeh
Malware Config
Extracted
redline
1310
79.137.192.57:48771
-
auth_value
feb5f5c29913f32658637e553762a40e
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
54869cbab7c7f0273dd9b6aaa1ea0f6e029348909b40fa48b721bc1fa49f7f51.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ