redline | 0x0006000000023134-191[.]dat | Triage

Sharing

General

Target

0x0006000000023134-191.dat
Size

168KB
MD5

3a49be5cdae6705bce250bf17a9729a0
SHA1

d7e3265360e5516980a839b9638338b722ce290e
SHA256

b08c9b5fbd5c8a5f35d9278d7c6337cf1ba329d9ad810095d683d43317d849ad
SHA512

53a892b1a2d94d8d15c64a707d15f2c51c1ac6d317af18e98837c98f5aea4de6320d88eb942e82202f37bdbac77c96c0d019f02c257bfb1cf6ca4c6cf15983f0
SSDEEP

3072:8kmfv4r8W2qTvI2t2qVwoMTOIkvl98e8hg:gfvhZ/Rfkvl9

Score

10^/10

mixa redline

Malware Config

Extracted

Family

redline

Botnet

mixa

C2

185.161.248.75:4132

Attributes

auth_value
9d14534b25ac495ab25b59800acf3bb2

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x0006000000023134-191.dat

Files

0x0006000000023134-191.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ