redline | 0x00090000000122f5-78[.]dat | Triage

Sharing

General

Target

0x00090000000122f5-78.dat
Size

168KB
MD5

e1f97c3658b29fa75a3838125c0c8078
SHA1

15da3ebdf2b4971adbd9f0fc4d7e082081a06286
SHA256

0d4e7759bb8523cf8c79be0e4b1a107a8a5ef02b4c60631e403687e070a73704
SHA512

1a8000ca9c83f9a36ba41d64eb50248a8ec7a15ca0c01af7a6075f25e4533b61a518296e04502559ecabdece72e7284b4e02c288f32ea1e2cbd147da27b2be54
SSDEEP

3072:CemQ6p8Wc6+yoIyqCqVMEODInQ6FR8e8h5:CemBY6oIyvjGnQ6FR

Score

10^/10

dusa redline

Malware Config

Extracted

Family

redline

Botnet

dusa

C2

83.97.73.126:19046

Attributes

auth_value
ee896466545fedf9de5406175fb82de5

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x00090000000122f5-78.dat

Files

0x00090000000122f5-78.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ