redline | j2624853[.]bin[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

j2624853.bin.exe
Size

175KB
MD5

79d695993551d95d1dc462067311249d
SHA1

a09b6be89d4cb4d0e77d654b80bf73871fc5ae90
SHA256

9da891fbecacaf934f0e24ed59d13540062b32165dd914857a8af4109cc6340b
SHA512

9e53d532febd0221c9ec9720b2ffa3ef3ec59db0c1d7894d3d071fc3a1725255031225420d718427ac17e56e4fcfa46f66468d4976a160a371f41e20ab61b891
SSDEEP

3072:cMC/Huw6uatUGpExN8aOqcJ9Fw/8e8h9:cK1Uef9DFw/

Score

10^/10

roma redline

Malware Config

Extracted

Family

redline

Botnet

roma

C2

77.91.68.56:19071

Attributes

auth_value
f099c2cf92834dbc554a94e1456cf576

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
j2624853.bin.exe

Files

j2624853.bin.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ