redline | n3568714[.]exe | Triage

Sharing

General

Target

n3568714.exe
Size

174KB
MD5

b4433e696be6fa00fc1c5987275afd06
SHA1

0c38b17a9bd764e961b53ff2201263168aa83a1c
SHA256

2ec867d3fed13aacf89527d44a906339070f00c381b45eb4d65d9db9267226c0
SHA512

247f3086c11a7daba2888b075320468996b5fd48201480cae5b37d62d17ac19cf6c82b0132e887fc25c63f3b9d6d3f72dbba4b0ef72df0d8ff8249c380c49ac3
SSDEEP

3072:P2mFIM+HRpvScF2KqxNH6HJ5blkL9pkRTf8e8hH:P23RkcF2KCmblkL9pkRTf

Score

10^/10

zahar redline

Malware Config

Extracted

Family

redline

Botnet

zahar

C2

77.91.68.56:19071

Attributes

auth_value
94c55a31fcf1761f07eeb4a0c6fb74fa

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
n3568714.exe

Files

n3568714.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ