redline | 0x000600000002316c-161[.]dat | Triage

Sharing

General

Target

0x000600000002316c-161.dat
Size

168KB
MD5

08ff3d597c112cef0dacdf77e020d580
SHA1

693de4609e08f7626d05c78b848abefa2e83a0df
SHA256

c61e7f08640e7270f85e6f526f6f4d9ed9218df37c250d9fd59006ac3a895429
SHA512

418c4042d92057fbe2e2fb488632d59f64b4d6f3b50f5be89c35d713f9a4d6712094ef944404752df685cd177fe78376c12e8bd0cb00ac4b47d10c77a0cf4415
SSDEEP

1536:Gi3n6ICpqtqhVZCGWK5JPzz8WJ8surO5gbBvdATGqVIBWbug8DLTGqU584wYkk8X:Gikw038WSHI6BFRqVIgE3jU5h8e8hR

Score

10^/10

dusa redline

Malware Config

Extracted

Family

redline

Botnet

dusa

C2

83.97.73.127:19045

Attributes

auth_value
ee896466545fedf9de5406175fb82de5

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x000600000002316c-161.dat

Files

0x000600000002316c-161.dat
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ