redline | 0x0007000000015c96-58[.]dat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0x0007000000015c96-58.dat
Size

174KB
MD5

994b24f534769f2e44937d281b56aadc
SHA1

3bc856c7359d4f47b80270c0a82d6e81dcc07d5a
SHA256

6463a1b7b866db87476d210e421bfa27473d15032c61f21cb1c70d20195606e4
SHA512

b368e282f7659fb5b2f57c34f736810ba0984706712838570949a0bd7a65cd23da86fc369bb3645da91f022b6dc78c13cf6db0a37ce3fa424c85c8d785a165f3
SSDEEP

3072:nGWIIktOuI03yz++OBio2HH+EE0Wti+3tqgR+jJt8e8hA:GWIauI03yz+o+EE0u3tqgR+jL

Score

10^/10

stas redline

Malware Config

Extracted

Family

redline

Botnet

stas

C2

77.91.124.82:19071

Attributes

auth_value
db6d96c4eade05afc28c31d9ad73a73c

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x0007000000015c96-58.dat

Files

0x0007000000015c96-58.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ