redline | 0x0009000000012304-68[.]dat | Triage

Sharing

General

Target

0x0009000000012304-68.dat
Size

168KB
MD5

4eda5a2cd5d6e330a522a9a7a1b23c09
SHA1

98012c480fee7a8c3b442aea61336d0c9a0569e5
SHA256

985f6d8d549147f73b57e986bd89d65d161077ca7bbf08af13f146aebd2692f4
SHA512

da83b2d29bd17e90e0ac9a57ccd93df13710e941d60ac8c617aa8c3d8258c66acb4034d736b73c6e847bb4788d569c05dd0d4c821ef6ccb9f5de3a29d1c80ae1
SSDEEP

1536:Eq24CeDYZ5QqlVZRGWoysHrt3la3cOo+TGqV0buhoxW7/C6gX83wYk/8e8hK:EObYH2HaXEqVMVxI/C6gXh8e8hK

Score

10^/10

daris redline

Malware Config

Extracted

Family

redline

Botnet

daris

C2

217.196.96.56:4138

Attributes

auth_value
3491f24ae0250969cd45ce4b3fe77549

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x0009000000012304-68.dat

Files

0x0009000000012304-68.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ