redline | h8236901[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

h8236901.exe
Size

174KB
MD5

d4455dc550c2c56b6b8ad28921e90096
SHA1

7c4fc528a1eda1621aa993a126dac343300bf854
SHA256

55d42fdbed7bd2cb2aa9c420dc44fee602d4339f073a277d677971e592580280
SHA512

f77127dbd7fef4ab8012fe83138bbbb8ef7aabaca4ec70ce473f3a5544579fea4bd297395d34faa34bf198a6cffbcab08b956c5075902a94f15f9febeb0bd5a9
SSDEEP

3072:0LNyZAaI0gjhGtO04n28qAo+71oE0Gfzj1kqvJ88e8hg:0LDaI0gjhG3Ao+ZoE0A1kqv6

Score

10^/10

black redline

Malware Config

Extracted

Family

redline

Botnet

black

C2

77.91.124.82:19071

Attributes

auth_value
c5887216cebc5a219113738140bc3047

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
h8236901.exe

Files

h8236901.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ