redline | h0148896[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

h0148896.exe
Size

174KB
MD5

92fafc33e658b62f46008d2d547650de
SHA1

4d2a3b7b5ce7ae24131e58d9c37661c0fdf16bef
SHA256

ce176f99a1d99eded9b6b2a0efe79a9b23ad0d83c0731041a3ab44f8105e867e
SHA512

90b6c3abc327425d3c80c4b29ad0bf2d9f7abb3da898e2988bcdef26e4177b2087ed0b8a290d8833d2bd15ca943fc8a42d92ef71c387a29f3882359bf38ae10a
SSDEEP

3072:0GRk2OCSnBI0eVY+UxO5FY+bZHoGAxIcE0MLEXs08JYJw8e8hO:22EBI0eVVU0ZIGACcE0ot08JY2

Score

10^/10

petin redline

Malware Config

Extracted

Family

redline

Botnet

petin

C2

77.91.124.82:19071

Attributes

auth_value
f6cf7a48c0291d1ef5a3440429827d6d

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
h0148896.exe

Files

h0148896.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ