redline | 213678e1066f317db7eeb295a012bb56[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

213678e1066f317db7eeb295a012bb56.bin
Size

50KB
MD5

5de58e1d80daa18d7f72da7200db7bad
SHA1

8da938db2efe4e76b13d876b8b44df12d04ba566
SHA256

6c7524955960ddffbcd4e7e719f1b880101a81ed02337af8ae6da65d6532e637
SHA512

112f5359a3c465506d7aa80e8dba13378b02cce872a26f4f18458711264cbfe9df7830d82ee0579390d8cc7809b92f482f97bd33cf033ede885abb1d736c949d
SSDEEP

1536:60Letlmhr7+azcbUueGkZ0b3Y5+k35QPUT2qYUNT:60Le3m5+kZYJ0T9T

Score

10^/10

diza redline

Malware Config

Extracted

Family

redline

Botnet

diza

C2

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/379bc2705dbddff662caace1e146bc2fc774ee711e6652462ef798fb8bbf91d5.exe

Files

213678e1066f317db7eeb295a012bb56.bin
.zip

Password: infected
379bc2705dbddff662caace1e146bc2fc774ee711e6652462ef798fb8bbf91d5.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ