redline | Burlador ADB[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Burlador ADB.exe
Size

95KB
MD5

e08afaf6d4c2acf34fd8ae692229165c
SHA1

ff00e6edf561036b27b2287ef7a508087728feb1
SHA256

89f4b1c57682b4ed00291e4bdebb7fb48c4c0db63bb224734d143bbe385ee32b
SHA512

b469b71353c347dc52a919fcfb3a5bbd6da6ef0218989d21f4bb2cdb45d455e7a21d352843d9f1fbdbf280149d7b4d3d0023c93273f7258a65a493dd02700753
SSDEEP

1536:1qsGfq+TmlbG6jejoigI/43Ywzi0Zb78ivombfexv0ujXyyed2f3tmulgS6pg:z0taY/+zi0ZbYe1g0ujyzd3g

Score

10^/10

cheat redline

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

52.67.16.71:80

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

Burlador ADB.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ