redline | 0x000700000001645b-101[.]dat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0x000700000001645b-101.dat
Size

175KB
MD5

83eb3ba5c8ecf0fd660bb6e056add709
SHA1

17626951edf42fcbac9090b124dd8868b91d9373
SHA256

07653589162bda248ab30b650c6d81d8eece0d475d3e8895e6c4b70961ef72d2
SHA512

88ade4c24de17f29ea9061bfa6d618218b6e81be395eeeb84d7b09d8e800c6f140292b37cfa7f270da96fa7e69127c5edcb13a9d15af7a1e3d7f8bce1a87f03d
SSDEEP

3072:Ep+ZGv0jI0px5X4OCoYecFxUwsE0GzhXcroONJs8e8hc:y+pjI0px5X2bsE0acroONK

Score

10^/10

savin redline

Malware Config

Extracted

Family

redline

Botnet

savin

C2

77.91.124.156:19071

Attributes

auth_value
a1a05b810428195ab7bb63b132ea0c8d

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x000700000001645b-101.dat

Files

0x000700000001645b-101.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ