redline | 0x00070000000131d4-106[.]dat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0x00070000000131d4-106.dat
Size

168KB
MD5

d4faf9840115959e51d4ee1acab73437
SHA1

4bd6b5c8b86aeba459a463171fbc0845f80b8721
SHA256

94d7ea96c4da32989505674a7222a62113919220480eb8e3ce2527324749269e
SHA512

e3d8cb11feb085c58e993e2849721b7bc1ac3bf9deaeed311deff31f601f97e84fb38fb6f1eabe830b5d23d86cb541ef17eff009b9a2efd872305419b9127833
SSDEEP

3072:4/E08RWTHuf5dCKZStD7Cp7qVMdfQrJ7z8e8hs:UQWTuTZ37KrJ7z

Score

10^/10

lipo redline

Malware Config

Extracted

Family

redline

Botnet

lipo

C2

217.196.96.101:4132

Attributes

auth_value
3183df2d03b17daa3c5ecc95e60086a5

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x00070000000131d4-106.dat

Files

0x00070000000131d4-106.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ