redline | 0x001b000000015c6c-55[.]dat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0x001b000000015c6c-55.dat
Size

174KB
MD5

cc228c871f50125ae208d85b0eba4955
SHA1

4107948c3ff615abeb5c437722d6ed8015f75bac
SHA256

f7f2311e0bf2908fcce7a706ae4942f3885fb46abd6a119454013ed3a5ab81f7
SHA512

7bcc6d3b3d41293452cf259abedb5ebe93561f5e5812d60cd9c5e00af949c78b473add6365cb366e5b0bf41908423703a0adc984bb584dd0ab75b5ce38346c10
SSDEEP

3072:0AD3SyJcI0L/oNdOIrBQZqkoj6tLEE0C/QZ4FkJJd8e8hU:0AD/cI0L/oNmqkoCLEE014FkJ7

Score

10^/10

vaga redline

Malware Config

Extracted

Family

redline

Botnet

vaga

C2

77.91.124.73:19071

Attributes

auth_value
393905212ded984248e8e000e612d4fe

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x001b000000015c6c-55.dat

Files

0x001b000000015c6c-55.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ