redline | 1f35d891cf93853d11c166ac59f66f8e[.]exe

General

Target
1f35d891cf93853d11c166ac59f66f8e.exe
Size 137KB
Sample221127-j548ksff2s
SHA256 e248d50df9fc8cc6ee14b6b703c623ca29019a673a5428f54851b085459e11b5
MD5 1f35d891cf93853d11c166ac59f66f8e
SHA1 58804865ccfd2b0c2a4275aa43824c501d39f70d
SHA512 e562a58154ed55a7a535c4061117447b3baad50d594092caf1cd518b1a12b5f0d66ebb1cbbfea518f4ad4223d70486e1fda6adf0dbdbe70f221fec7a79728e85
SSDEEP 3072:OYO/ZMTFh/+wY7DcNIc8xxs9999vlBWFJoRXYhISS85:OYMZMBh/jYkic/TNBYh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline

Malware Config

Extracted

Family

redline

C2

82.115.223.210:24221

Attributes

auth_value
98c3fb61423ba00ba4fb9ed7d895151c

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

File Explorer

1f35d891cf93853d11c166ac59f66f8e.exe

.exe 137KB

1f35d891cf93853d11c166ac59f66f8e.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 e248d50df9fc8cc6ee14b6b703c623ca29019a673a5428f54851b085459e11b5
MD5 1f35d891cf93853d11c166ac59f66f8e
SHA1 58804865ccfd2b0c2a4275aa43824c501d39f70d
SHA512 e562a58154ed55a7a535c4061117447b3baad50d594092caf1cd518b1a12b5f0d66ebb1cbbfea518f4ad4223d70486e1fda6adf0dbdbe70f221fec7a79728e85
SSDEEP 3072:OYO/ZMTFh/+wY7DcNIc8xxs9999vlBWFJoRXYhISS85:OYMZMBh/jYkic/TNBYh
MD5 SHA1 SHA512 SSDEEP

windows x86

RedLine payload

Minor OS version

Major OS version

Entry point

139638

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing