redline | h1671165[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

h1671165.exe
Size

174KB
MD5

fd94fde19fe8c56ea4e6fb60ee7a62f9
SHA1

82c5535dd2a2dae3e9bdc673bd9f78ae67d56db1
SHA256

ff922becf1b60549f74ec0b827933003c142b10a18d4c1a04804568ac7016f50
SHA512

9c2beacd8a99fcce19184bbd86cc71e4fcdd0a0cb1cfd616f1961d167f8a7c9f9e0775880ffe83f0afd699fef43023c284068e400974f495f2b029dbb7f66df5
SSDEEP

3072:0GRk2OCSnBI0eVY+UxO5FY+bZHoGAxIcE0MLEXs08JYJw8e8hO:22EBI0eVVU0ZIGACcE0ot08JY2

Score

10^/10

petin redline

Malware Config

Extracted

Family

redline

Botnet

petin

C2

77.91.124.82:19071

Attributes

auth_value
f6cf7a48c0291d1ef5a3440429827d6d

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
h1671165.exe

Files

h1671165.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ