redline | file[.]exe

General

Target
file.exe
Size 137KB
Sample221007-zd5b9sdeb7
SHA256 1a0e5a1a5df402e3b102af1e2f57ccd905038f7b1b6f361e35eafe31df424d28
MD5 611b405421c67c981ca3cb3aa572e106
SHA1 7e3a64ba139673296a293885644bc95bfc7ec0a3
SHA512 53602692ee64e619c4487d135473e3dcfe43c75177eaca99a69e6d0808d910ec28f402235c3eaf6d0f591038ca7ca1ae280fbaccaf6d9f53945291d0de07aecd
SSDEEP 3072:lYO/ZMTFrbSI4r7CvAkkR+BYZVeDFJ4RXGhtSSwD:lYMZMBrbSIM2AkkIBYakBGh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

123 redline

Malware Config

Extracted

Family

redline

Botnet

123

C2

80.76.51.172:19241

Attributes

auth_value
54712e96bf1c2aada4bff7709fe3dc3f

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

File Explorer

file.exe

.exe 137KB

file.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 1a0e5a1a5df402e3b102af1e2f57ccd905038f7b1b6f361e35eafe31df424d28
MD5 611b405421c67c981ca3cb3aa572e106
SHA1 7e3a64ba139673296a293885644bc95bfc7ec0a3
SHA512 53602692ee64e619c4487d135473e3dcfe43c75177eaca99a69e6d0808d910ec28f402235c3eaf6d0f591038ca7ca1ae280fbaccaf6d9f53945291d0de07aecd
SSDEEP 3072:lYO/ZMTFrbSI4r7CvAkkR+BYZVeDFJ4RXGhtSSwD:lYMZMBrbSIM2AkkIBYakBGh
MD5 SHA1 SHA512 SSDEEP

windows x86

RedLine payload

Minor OS version

Major OS version

Entry point

139574

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing