redline | aa97a547b293098dde1f24f772e964f4[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aa97a547b293098dde1f24f772e964f4.bin
Size

50KB
MD5

17a4da634d555f9f2a9a604f5b081efb
SHA1

4cb4094fc2c91f19e4c0fbba3dceebc4de7056c4
SHA256

a1a6d9ab2065894087f732716477b9525d0878f96590f05cb25bf646009000f0
SHA512

c0d28cd0d7703a11cb099d158f2b4c0412f17139fa5a7df9728715226da22168d4986556689620039cd6c46a95ae7f702c65d34ebf0ab8bd344751e54cdd8e0a
SSDEEP

1536:vo+BulroWhSVjSqQwibLQ68gfML9Ikx3fs:A+slroSSVjJQ/l8SC2ktfs

Score

10^/10

duper redline

Malware Config

Extracted

Family

redline

Botnet

duper

C2

77.91.68.253:19065

Attributes

auth_value
57e17ebbdb18f4882b95fe05402ef1c8

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/7d9b13c8790e1001f15a295f6b23ddddefb37c0c574464d8565b16525e998c7b.exe

Files

aa97a547b293098dde1f24f772e964f4.bin
.zip

Password: infected
7d9b13c8790e1001f15a295f6b23ddddefb37c0c574464d8565b16525e998c7b.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ