redline | 156dcb5153f29700190b4cc20914bce6[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

156dcb5153f29700190b4cc20914bce6.bin
Size

50KB
MD5

f8453b106345eff3ef82b3bbde657594
SHA1

8f950574c48868fa2fdab120d0b6aef4a903f502
SHA256

158ab5933ee0d3e218563dd3d4ec9ecdf36393496ff205de61d01493ccc3d9ed
SHA512

ca910c76f497926a95ddf8bb8f07184b08452e90cbe7d38ede05d30415d33355a7b65993f2dd1d2b7250a54d92445c245eddd30417a1314f68a89fbdbb495d56
SSDEEP

1536:JNtnDPLmcB4MhUaCZGmd0VKbpWnhH8pvSx/:JLFKwDComCKboKq9

Score

10^/10

diza redline

Malware Config

Extracted

Family

redline

Botnet

diza

C2

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/827781f56c96b9f3aeb17555e9ce30e68d11c746c5b8d8c6ef602a4e3a7e873a.exe

Files

156dcb5153f29700190b4cc20914bce6.bin
.zip

Password: infected
827781f56c96b9f3aeb17555e9ce30e68d11c746c5b8d8c6ef602a4e3a7e873a.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ