redline | file[.]exe

General

Target
file.exe
Size 137KB
Sample221115-v9ez2afa62
SHA256 9aecf1abe46d70a02d17800dbe3a8bda2f72f87456abb0dda69c7f7920cddb60
MD5 d8fa5ec2e689dfbc2559ef3a5cb69ca2
SHA1 c21dd2d112d69f52318dbef8bdeea892e09c7d19
SHA512 860d3ce9c0f0dc421773b09f54b47cc42faa0d8d702fb2fb901c0d191a6babde1b8d3eb339bb947c951574cd8ae3e3fb4d1bf5c1a8fa58323fea5f4ae7c163da
SSDEEP 3072:aYO/ZMTFjr+sIjLHydBupA8vWFjyRPkhCSSw6:aYMZMBjr3I/0BYBpkh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

all redline

Malware Config

Extracted

Family

redline

Botnet

all

C2

37.139.128.203:44588

Attributes

auth_value
32aa4d6df6f06883d86b201db44480e4

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

File Explorer

file.exe

.exe 137KB

file.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9aecf1abe46d70a02d17800dbe3a8bda2f72f87456abb0dda69c7f7920cddb60
MD5 d8fa5ec2e689dfbc2559ef3a5cb69ca2
SHA1 c21dd2d112d69f52318dbef8bdeea892e09c7d19
SHA512 860d3ce9c0f0dc421773b09f54b47cc42faa0d8d702fb2fb901c0d191a6babde1b8d3eb339bb947c951574cd8ae3e3fb4d1bf5c1a8fa58323fea5f4ae7c163da
SSDEEP 3072:aYO/ZMTFjr+sIjLHydBupA8vWFjyRPkhCSSw6:aYMZMBjr3I/0BYBpkh
MD5 SHA1 SHA512 SSDEEP

windows x86

RedLine payload

Minor OS version

Major OS version

Entry point

139654

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing