redline | 06f49c26163af6ccef24778065b06a7b[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

06f49c26163af6ccef24778065b06a7b.bin
Size

62KB
MD5

bd2b61bbb735486cc12ce375afdce284
SHA1

4e4ce1e9ce78bf6a287e8aef453f503674cbc4af
SHA256

54ad6453dce55eb759cb3c1589bdc6798d0fc589050917d2f7c00076737fc612
SHA512

9364c1e7d50856debbf96afd1d55e90969ed079d75172034875db7bfcb87b2c3dcde89ce2a53f2c37f88efac715c3fdce3bbd24582e69a08a608ea5fdbad0ce6
SSDEEP

1536:sMubUfLeh3nvyOq5RbkgJSBYpO7/rzHwXJyLb:stbSkvyOq33UL7DzsyLb

Score

10^/10

redline

Malware Config

Signatures

RedLine payload 1 IoCs

resource	yara_rule
static1/unpack001/61aedb263020f4abacca1130ecda6f04eb7e99f838ccd0955a6fa2930379aa1c.exe	family_redline

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/61aedb263020f4abacca1130ecda6f04eb7e99f838ccd0955a6fa2930379aa1c.exe

Files

06f49c26163af6ccef24778065b06a7b.bin
.zip

Password: infected
61aedb263020f4abacca1130ecda6f04eb7e99f838ccd0955a6fa2930379aa1c.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ