redline | 353b564e3ca3c1532c28a4ce9e3ca1a8[.]exe

General

Target
353b564e3ca3c1532c28a4ce9e3ca1a8.exe
Size 107KB
Sample220706-cjebpshdh3
SHA256 01219e8918a7d225564744f3b84c417ebdee23639b18901ba2a9fe496c5e9ccd
MD5 353b564e3ca3c1532c28a4ce9e3ca1a8
SHA1 ae1305cab75d9a4143b3faf347d0c186b16939a5
SHA512 54736d963179a2060110d709a81561fa056d051f3bf04a22262c11aefeb9fb26376f9877ca0662d69e39ca3725b4bf874b70e2bd39ae15c52abbf90c5e51c5bc
SSDEEP 3072:fcvFBxCYapiAI3nGrCliuoc7c3TYCTxht4EASNF:fcvfp3litGc3Dxht4jS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

100 redline

Malware Config

Extracted

Family

redline

Botnet

100

C2

185.17.0.63:32327

Attributes

auth_value
8c479b82a6164e0a0f7d75dcff4b60b4

Signatures

RedLine Payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

File Explorer

353b564e3ca3c1532c28a4ce9e3ca1a8.exe

.exe 107KB

353b564e3ca3c1532c28a4ce9e3ca1a8.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 01219e8918a7d225564744f3b84c417ebdee23639b18901ba2a9fe496c5e9ccd
MD5 353b564e3ca3c1532c28a4ce9e3ca1a8
SHA1 ae1305cab75d9a4143b3faf347d0c186b16939a5
SHA512 54736d963179a2060110d709a81561fa056d051f3bf04a22262c11aefeb9fb26376f9877ca0662d69e39ca3725b4bf874b70e2bd39ae15c52abbf90c5e51c5bc
SSDEEP 3072:fcvFBxCYapiAI3nGrCliuoc7c3TYCTxht4EASNF:fcvfp3litGc3Dxht4jS
MD5 SHA1 SHA512 SSDEEP

windows x86

RedLine Payload

Minor OS version

Major OS version

Entry point

109922

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing