redline | 0x0008000000012316-94[.]dat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0x0008000000012316-94.dat
Size

168KB
MD5

bc61fa62b24f55ae6234ef027ee12773
SHA1

084496b04eb5d3580b54807195e0dbf31afb67c7
SHA256

4b8f159dded43e72eb5e45a5475b6414ce1f134dc87fb92b329a8c7c4832a3b5
SHA512

7b571631b2bf10a9bb9148089284336ce77a3e695d6b2fe3308281aea31b6d99da0d8170c81e28c3efd85686bdc84eebfbbd8f7748117124a7db6b24f85cc548
SSDEEP

1536:I9xKHrNq1qhVZCGWv/7C6PY78Wyp2cGAiiGAyWtTGqVARWbuaO9wSAiz84wYkM8e:IOMtc8Wyp2PYkqVAQGySAiz58e8hE

Score

10^/10

liza redline

Malware Config

Extracted

Family

redline

Botnet

liza

C2

83.97.73.127:19045

Attributes

auth_value
198e3e9b188d6cfab0a2b0fb100bb7c5

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x0008000000012316-94.dat

Files

0x0008000000012316-94.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ