redline | 0x0037000000015c4d-94[.]dat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0x0037000000015c4d-94.dat
Size

172KB
MD5

08d05601be7784a0153f05d21093f484
SHA1

05ef77ec90b27a5493c79a4534c117b0e038d8e9
SHA256

faadcd47b64f0e3272d3b1808645165b7a7801a0ab44d2164ccc61d88a86427f
SHA512

b11121a167e62178e5a4d44bc92627ba9a73fa66bb23a68c21fb8bd1059bb58cd890606b1ceacbc33808f0a1f73338d8495b4da65e993c114a39b5e2aa70fe21
SSDEEP

3072:gciW+Zh8+WtcTIwxNm4/Lk/DWjAn8e8hJ:gciv7IJT/DWjAn

Score

10^/10

nasa redline

Malware Config

Extracted

Family

redline

Botnet

nasa

C2

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x0037000000015c4d-94.dat

Files

0x0037000000015c4d-94.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ