redline | 3cda6eaa92bdf590a3fb4bc3945fd2f74eac9e27cb9bb018d1c3aa270162312e[.]zip

General

Target

3cda6eaa92bdf590a3fb4bc3945fd2f74eac9e27cb9bb018d1c3aa270162312e.zip
Size

64KB
MD5

88b6f904ea3c218577885c437bca17f7
SHA1

c375451e61ac8c3f471d109cd8e3cdbe98f8e4a0
SHA256

751ff133546729b96dc67111e05fb28ab7691d41f0d5f711c7a049785bcdae93
SHA512

7f862241967638f45dd9ac2f81be3080e4a3c006ac9983b6ef5d4603e3eaa627deaf4f46454655cf7c23bf1d59ce71805cd5adccedf3a7f711ade17fdde466b4
SSDEEP

1536:lXh7vIAX0XKTgC/Jrw9U89SpNT50EDcgmHkhELDMxC2+d4ZSHMF/:tJvuK8S69SXTrDcvyELPfmfd

Score

10^/10

lider redline

Family

redline

Botnet

lider

C2

217.196.96.102:4132

Attributes

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3cda6eaa92bdf590a3fb4bc3945fd2f74eac9e27cb9bb018d1c3aa270162312e

3cda6eaa92bdf590a3fb4bc3945fd2f74eac9e27cb9bb018d1c3aa270162312e.zip
.zip

Password: infected
3cda6eaa92bdf590a3fb4bc3945fd2f74eac9e27cb9bb018d1c3aa270162312e
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ