redline | 0x0006000000018685-74[.]dat | Triage

Sharing

General

Target

0x0006000000018685-74.dat
Size

175KB
MD5

1aeb92aefb323576a0db2de7de12dcb6
SHA1

f6e378ac7146fdb4cd093fc54dd7ecc02bb4e4be
SHA256

4cec427b41b4a136e87cb8d35937cd9389417eecf200d205554807b84954aee2
SHA512

1948427b59691f921d9a1cc92d161537476138477e054129a19d1359a3253f34a2e9ce440367f17fd86b7d91d6c90ed32f32109f6167150acba16ceec9b30737
SSDEEP

3072:0P7NPifVI0pMLGKOmT0xLbE2FE0CBFOshR0cJj8e8hv:e7sVI0pMLG/bxFE0GhR0cV

Score

10^/10

mrak redline

Malware Config

Extracted

Family

redline

Botnet

mrak

C2

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x0006000000018685-74.dat

Files

0x0006000000018685-74.dat
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ