redline | a55ac1675024fe2364102cd1410ec105b443d0c866d68ee7cf3a5ba060d90e5b | Triage

Sharing

General

Target

a55ac1675024fe2364102cd1410ec105b443d0c866d68ee7cf3a5ba060d90e5b
Size

106KB
MD5

757d53805846243e6e7e67d8ec6d0950
SHA1

cca21bba69b60085fa0b1d59b4696c1d53f61308
SHA256

a55ac1675024fe2364102cd1410ec105b443d0c866d68ee7cf3a5ba060d90e5b
SHA512

4a33001fc9ee00fcedb477a3dd3d6249392b9878ff12d263bac9602f3ad62576842f138e1b1d8e376a08c55ebb18f3b98c8d6ac7bc3bdcd4f3a05fd9c6f23e18
SSDEEP

1536:FOpG0Ad02HDgzfdqKbN1gYg6mxcis2bZDKAn0jBobx4J9C00Ien:FOpLA9HDAfdByYg6mxHvDSOsIio

Score

10^/10

1612 redline

Malware Config

Extracted

Family

redline

Botnet

1612

C2

95.217.35.153:9678

Attributes

auth_value
b5a5176fed2f09773f56b63ef46db825

Signatures

RedLine payload 1 IoCs

Processes:

resource yara_rule

sample family_redline
Redline family
redline

Files

a55ac1675024fe2364102cd1410ec105b443d0c866d68ee7cf3a5ba060d90e5b
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

1d:ce:a2:64:23:8c:90:a4:42:3e:de:a0:97:d4:f4:b2
Certificate

Issuer

CN=Adoration,O=Paintwork Cityfying Inc.,C=2O,1.2.840.113549.1.9.1=#0c187375726c6965726e756e6e65727940676d61696c2e636f6d

Not Before

08-12-2021 21:00

Not After

15-12-2031 21:00

Subject

CN=Adoration,O=Paintwork Cityfying Inc.,C=2O,1.2.840.113549.1.9.1=#0c187375726c6965726e756e6e65727940676d61696c2e636f6d

a6:4c:6e:08:45:20:d7:37:52:41:65:53:bc:61:36:5c:c7:af:b5:19
Signer

Actual PE Digest

a6:4c:6e:08:45:20:d7:37:52:41:65:53:bc:61:36:5c:c7:af:b5:19

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ