redline | 0x000600000001b024-37[.]dat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0x000600000001b024-37.dat
Size

174KB
MD5

ae79b82cb8dcae54cc31055efd451ef3
SHA1

f33e7a5de05d3190a4d9e6b963abd3180a2dba42
SHA256

144e35652e4e820cfc0f38ed117efb6c666450902b2cc7eeaf0b150e1823ca8a
SHA512

b1ee24fa409c17f06383aa69cd37c4f86296cd80aba1b129c6f8dc9227a207cf31a18465aa85bd1eff9bcb03ee2a444ef53b061a7d548a6e2cb161e09ed06d95
SSDEEP

3072:itMMNILgWOI07QlEZO0pIAIH5uE0u3zAfbs9JN8e8hS:i2MyOI07QlE4uE0Wabs9L

Score

10^/10

jaja redline

Malware Config

Extracted

Family

redline

Botnet

jaja

C2

77.91.124.73:19071

Attributes

auth_value
3670179d176ca399ed08e7914610b43c

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x000600000001b024-37.dat

Files

0x000600000001b024-37.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ