redline | 9b22afc7931938bf960bce1fe68675f43c0cd044a60aeca4d1e5ef8358bd667a

General

Target

9b22afc7931938bf960bce1fe68675f43c0cd044a60aeca4d1e5ef8358bd667a
Size

115KB
MD5

41bfd5322060be42d5cb4e6e10b083b1
SHA1

72cef546a11dda42b864fa8e56cc92f720a7db0b
SHA256

9b22afc7931938bf960bce1fe68675f43c0cd044a60aeca4d1e5ef8358bd667a
SHA512

656d4fca9d8b664c6052294b9da994ea6e6cfec6b440d99f0ccb388a5aebdd244e9af93b535d9849ca2a5e7ff7341703861278764a6589dd2235d248368c9ad5
SSDEEP

3072:SbGWN1y1JggwXVBaQC5cDyxaBFhOxPRA/CJvjW0fL:oi2gIbCWDrFGZA/0jW0fL

Score

10^/10

25072023 redline

Family

redline

Botnet

25072023

C2

185.215.113.67:40960

RedLine payload 1 IoCs

resource	yara_rule
static1/unpack001/27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b.exe	family_redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b.exe

9b22afc7931938bf960bce1fe68675f43c0cd044a60aeca4d1e5ef8358bd667a
.zip

Password: infected
27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ