redline | 0x00070000000139ec-109[.]dat | Triage

Sharing

General

Target

0x00070000000139ec-109.dat
Size

172KB
MD5

ea4fb3e554a082ec34a006ac62ccb050
SHA1

06f683c7bbcce20114d6d05bdfc649ce6ba4a15b
SHA256

1c56869fda91a9145a48b7865bed43072002f0e3cfa0b2cfa3c01f0aeecf7cc1
SHA512

f33a8f3eafa3bddd7c6d94d1756ed4dd20d3b1d276cfe93d67092fadb86ea4bc1c8e64143b8d35917cd52d1ff6efff8bddf221fed708a16f310b1012ae7ad57c
SSDEEP

3072:QBF8QOIKbe97H9rWRxNB2NjrOSHy+8e8hg:q8MVdaHMOSHy+

Score

10^/10

maxi redline

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19048

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Redline family
redline
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

0x00070000000139ec-109.dat

Files

0x00070000000139ec-109.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ