redline | 56B5E2BAB55DB6128F588D860065027C8F01E5ABECE0A[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

56B5E2BAB55DB6128F588D860065027C8F01E5ABECE0A.exe
Size

104KB
MD5

d8c401e48b035837454fd9c4b8dfe3d1
SHA1

50650c0fb8a95e2c13b1f3f708aa87309dde68d0
SHA256

56b5e2bab55db6128f588d860065027c8f01e5abece0ace2c1d73b95c81b4583
SHA512

6fa68652a13dd3ba3edcc3918acdf7d48eb226361a47facc3124a7ba2a631bc37e87bb148916faaf301c91f24bc773dabe84803ee23a02542dd80e83ce2e5743
SSDEEP

3072:5DgTD4wbi6e8gQFCkQK6nHiRhu3Vzat3NPI9vDX:A4wi6e8gQ8Gh4h

Score

10^/10

privat3 redline

Malware Config

Extracted

Family

redline

Botnet

privat3

dorasandeau.xyz:81

teylerityah.xyz:81

leanaengama.xyz:81

Signatures

RedLine Payload 1 IoCs

Processes:

resource yara_rule

sample family_redline
Redline family
redline

resource	yara_rule
sample	family_redline

Files

56B5E2BAB55DB6128F588D860065027C8F01E5ABECE0A.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

3c:bb:85:77:34:57:43:83:4c:e3:dd:c5:80:95:62:eb
Certificate

Issuer

CN=Wigwag,O=Resemblers Merycism Inc.,C=24,1.2.840.113549.1.9.1=#0c197068616c616e6765696e6a7572657240676d61696c2e636f6d

Not Before

02-11-2021 21:00

Not After

09-11-2031 21:00

Subject

CN=Wigwag,O=Resemblers Merycism Inc.,C=24,1.2.840.113549.1.9.1=#0c197068616c616e6765696e6a7572657240676d61696c2e636f6d

13:02:38:74:c5:0b:2f:49:53:89:4c:c3:88:d8:0a:17:7f:fe:49:aa
Signer

Actual PE Digest

13:02:38:74:c5:0b:2f:49:53:89:4c:c3:88:d8:0a:17:7f:fe:49:aa

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Wigwag,O=Resemblers Merycism Inc.,C=24,1.2.840.113549.1.9.1=#0c197068616c616e6765696e6a7572657240676d61696c2e636f6d

27-01-2022 16:14
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

3c:bb:85:77:34:57:43:83:4c:e3:dd:c5:80:95:62:ebCertificate

13:02:38:74:c5:0b:2f:49:53:89:4c:c3:88:d8:0a:17:7f:fe:49:aaSigner

Signature Validations

Verification

27-01-2022 16:14 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 98KB - Virtual size: 97KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 12B

3c:bb:85:77:34:57:43:83:4c:e3:dd:c5:80:95:62:eb
Certificate

13:02:38:74:c5:0b:2f:49:53:89:4c:c3:88:d8:0a:17:7f:fe:49:aa
Signer

27-01-2022 16:14
Valid: false

.text
Size: 98KB - Virtual size: 97KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 12B