redline | 0x0008000000012304-106[.]dat | Triage

Sharing

General

Target

0x0008000000012304-106.dat
Size

168KB
MD5

fb1fec3badc8a695c2d19f9fb9a9e6ee
SHA1

bb397ad54c0259ed42f7bf87daac1fd2ae430e96
SHA256

d11b847254dbd539c1ac1068f733d1571fd4f4f33ff05c9e9b6e3730ba0bc9e8
SHA512

82d2d843d58aec2f2408b8a3582d755a651df757d58ba7058c69be41f74c5758fcb846fe60179077c8daae2214b0db3dd055f93555465e043ebd144f1558c84e
SSDEEP

3072:ar8OrVrw8WbTQqVMU/X4nDH10iCrTQcg8e8hH:adrVss73DH10iCrTQcg

Score

10^/10

lurfa redline

Malware Config

Extracted

Family

redline

Botnet

lurfa

C2

217.196.96.102:4132

Attributes

auth_value
f6c26c2a5c6c25ae5b2e9abf31f6341d

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x0008000000012304-106.dat

Files

0x0008000000012304-106.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ