redline | tmp | Triage

Sharing

General

Target

tmp
Size

95KB
MD5

68afed1fdc812019d4f646f919025657
SHA1

d323a21f90c5d94ede89dbf4af56565c4673baa7
SHA256

5196aacf00f1f252962a14acf7e7f50680f52deaaa1e1d4d7850306e8211495a
SHA512

f605524ee87c66daf6e3fc588b66c9a66035753343cbcedf91c7b8fce6b0c58eafa36502fb0a237ee17c5ac7c52b80e808f60756935b81799d22edf65cbbe46b
SSDEEP

1536:9HqsyEq76ElbG6jejoigIY43Ywzi0Zb78ivombfexv0ujXyyed2O3tmulgS6pM:91r+68YY+zi0ZbYe1g0ujyzdMM

Score

10^/10

cheat redline

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

simplmizer.duckdns.org:61614

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

tmp
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ