redline | m6086951[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

m6086951.exe
Size

173KB
MD5

d4b946a17749da3c071ce43efeadc158
SHA1

754ecdcbd40f3d848bff04a1160b59afc29be7c5
SHA256

e64b8db360d634d5ddc72caf8cfaa4cf9759dc8b13e09da87c5b69787d73d0cc
SHA512

bb5924284453df1c06d7287b47dbba9f4b4a03a1cfd64fa358bbe5abb28fbe5b7f8916535d07f002459e3df967adbf2b782017874552a337a4dfe4b22f13b618
SSDEEP

1536:nmaXrOmFaG36sv0W7TEjrAgrHvYxr+cKmkVe7xNL+YQfzbustpVlUS70GkRU8e8c:TO8aw4LYxdx0e7xNh2fbUS7X8e8hK

Score

10^/10

lodka redline

Malware Config

Extracted

Family

redline

Botnet

lodka

C2

77.91.124.156:19071

Attributes

auth_value
76f99d6cc9332c02bb9728c3ba80d3a9

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
m6086951.exe

Files

m6086951.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ