redline | 0x00090000000122fa-81[.]dat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0x00090000000122fa-81.dat
Size

145KB
MD5

e3f2e384311e565d03e3c371ba3767ad
SHA1

0268a612c022e7b9d322ad330cf6b0dfafe8ed1b
SHA256

555e78878c2863defc867424db922a3c374da7d486aea6ad38398e6bd63e0892
SHA512

4496a1625f93b7391e8126bf9d628c6ab3954062d38b22ea3aba35809dc5f460360158d7a17eeb0d37f74e0d57b0909ebaf58f832050cb02f59f22fa20bed7d6
SSDEEP

3072:AV+m5cVQmRSxAX9GYM1vYWr9h/Z28e8hq:Aj4Zyz9h/M

Score

10^/10

dogma redline

Malware Config

Extracted

Family

redline

Botnet

dogma

C2

185.161.248.75:4132

Attributes

auth_value
d6c5d36e9aa03c956dc76aa0fcbe3639

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x00090000000122fa-81.dat

Files

0x00090000000122fa-81.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ