redline | build[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

build.exe
Size

95KB
MD5

d4255d9b417edb1eb387dcfdab699d6c
SHA1

279f9a80494977ee3e162916a2bf06adfe12b33d
SHA256

4f7359c44d359871264bac0e98850147439699acdf6124f6c6d2e5371a498d89
SHA512

dabeb55083dee9819a70813babcbaa30de877cbea13e99c37c5f8053e38f9aa0566ca7d45573c722454ba442407529b0119cfbd96d71965250e58a4dfe097f31
SSDEEP

1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2T3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzd/Y

Score

10^/10

cheat redline

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

172.31.22.246:13432

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

build.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ