redline | 0x000700000001269c-119[.]dat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0x000700000001269c-119.dat
Size

145KB
MD5

deef3419ef592aef5495b357e7164c29
SHA1

005056fb94b623764ff0af7cb4bc8293197af88e
SHA256

010e584e65f1baa277ec385097f38dd688e11842af4f0f1fb88c707d0addbbc2
SHA512

f12224ecf140bd78071c0b4bd120e1929ad08bf330f17958ce6d0327e6d60535d262be6c64d72e64f8ad8e90a7da8c54def33d93fe7aa7efaf5f6004ff871e5d
SSDEEP

3072:AV+m5cVQmRSxAX9GYM1vYWr9h/Z28e8hq:Aj4Zyz9h/M

Score

10^/10

dogma redline

Malware Config

Extracted

Family

redline

Botnet

dogma

C2

185.161.248.75:4132

Attributes

auth_value
d6c5d36e9aa03c956dc76aa0fcbe3639

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x000700000001269c-119.dat

Files

0x000700000001269c-119.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ