redline | file[.]exe

General

Target
file.exe
Size 359KB
Sample220921-m3dvdsgbe5
SHA256 884b73f88d5b30892c7cc1e60d8208d8cf14e5d1f2bebc6e58d7ba2ee31a634e
MD5 0da0463b36a0cf58b55472cf10c4d7f8
SHA1 a71873b5d24371a8eb85fff689726cb6bacc99bb
SHA512 f5a00a18c4e73568be5a92fb6208f008c05d89c2c293e108b95becaacf752c287ce2a66ed1dd549ef1ef7ee171244736ec86ff66d95d02d47037568b584c0098
SSDEEP 6144:OkqzbpuOiLuyFqLyELvxh0YVpjhrZ9oDeLPvag+U99ID2a07OUy+cleVsMImUVHK:SzbquyIRx3rrZ9oDeLPvag+U99ID2a0v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

10 redline

Malware Config

Extracted

Family

redline

Botnet

10

C2

79.110.62.196:26277

Attributes

auth_value
50effc85337100106cd47a926e7e6751

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

File Explorer

file.exe

.exe 359KB

file.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 884b73f88d5b30892c7cc1e60d8208d8cf14e5d1f2bebc6e58d7ba2ee31a634e
MD5 0da0463b36a0cf58b55472cf10c4d7f8
SHA1 a71873b5d24371a8eb85fff689726cb6bacc99bb
SHA512 f5a00a18c4e73568be5a92fb6208f008c05d89c2c293e108b95becaacf752c287ce2a66ed1dd549ef1ef7ee171244736ec86ff66d95d02d47037568b584c0098
SSDEEP 6144:OkqzbpuOiLuyFqLyELvxh0YVpjhrZ9oDeLPvag+U99ID2a07OUy+cleVsMImUVHK:SzbquyIRx3rrZ9oDeLPvag+U99ID2a0v
MD5 SHA1 SHA512 SSDEEP

windows x86

RedLine payload

Minor OS version

Major OS version

Entry point

371854

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing