General
-
Target
dc9d09314c0e04aca5ee0b5ff4e0e654961a7a9c42ebe98b146fcc0dbcac1785
-
Size
137KB
-
MD5
bcd28aedd4ce2e304e7edd98ca3cfcb2
-
SHA1
baed657cbf38cf9debf923e7036acdcf99165bc0
-
SHA256
dc9d09314c0e04aca5ee0b5ff4e0e654961a7a9c42ebe98b146fcc0dbcac1785
-
SHA512
c15cd5d7105f506aa342b4178392da5f666c5ec0cc1e6145650dcc51ce0e67654d3e54a6e79d33220678fd557ab8070b84e8e1e312afebc1c7395eab2bf62064
-
SSDEEP
3072:fYO/ZMTFNp+Oo+7O4saR9VpBJ/zWFbyRXchnSSc9:fYMZMBNpdoTjs/z9Bch
Malware Config
Extracted
redline
mao
77.73.134.251:4691
-
auth_value
a06897b11f5e600c4479f1b544acc337
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
dc9d09314c0e04aca5ee0b5ff4e0e654961a7a9c42ebe98b146fcc0dbcac1785.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ