redline | e283bb7023c01f111328e8db3b7f7807d279cdc4962b2b3685b7592d85622fa4

General

Target
e283bb7023c01f111328e8db3b7f7807d279cdc4962b2b3685b7592d85622fa4
Size 51KB
Sample241109-1rcd3sskh1
SHA256 e283bb7023c01f111328e8db3b7f7807d279cdc4962b2b3685b7592d85622fa4
MD5 fbcc34051c6df77fe483750e9bb1acd6
SHA1 11f660d41e8b8f9f75704c666491e90bb939b0af
SHA512 b6b607a6806975b80b701d5a3b3c7104adb9b7b251b0b2a012a8e96db8c78db7df174534a0bea908506c395876dd61c4a64a8dc7711d21f949a424ffd42e3451
SSDEEP 1536:9TU2C1KW+X1pX20w6Q7mwOxaurbncg+AUoQ3h2HJU8e/i:9Ar1R+l85U4urb3+d3h2pR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

renta redline

Malware Config

Extracted

Family

redline

Botnet

renta

C2

176.113.115.145:4125

Attributes

auth_value
359596fd5b36e9925ade4d9a1846bafb

Signatures

RedLine payload 1 IoCs

resource	yara_rule
static1/unpack001/9e59e07de288a01e8feb8e140ff18c2f2dbac94b6c90b29de054e0d9ce934079	family_redline

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/9e59e07de288a01e8feb8e140ff18c2f2dbac94b6c90b29de054e0d9ce934079

File Explorer

e283bb7023c01f111328e8db3b7f7807d279cdc4962b2b3685b7592d85622fa4

.zip 51KB
9e59e07de288a01e8feb8e140ff18c2f2dbac94b6c90b29de054e0d9ce934079

.exe 175KB

e283bb7023c01f111328e8db3b7f7807d279cdc4962b2b3685b7592d85622fa4

SHA256 e283bb7023c01f111328e8db3b7f7807d279cdc4962b2b3685b7592d85622fa4
MD5 fbcc34051c6df77fe483750e9bb1acd6
SHA1 11f660d41e8b8f9f75704c666491e90bb939b0af
SHA512 b6b607a6806975b80b701d5a3b3c7104adb9b7b251b0b2a012a8e96db8c78db7df174534a0bea908506c395876dd61c4a64a8dc7711d21f949a424ffd42e3451
SSDEEP 1536:9TU2C1KW+X1pX20w6Q7mwOxaurbncg+AUoQ3h2HJU8e/i:9Ar1R+l85U4urb3+d3h2pR
MD5 SHA1 SHA512 SSDEEP

Password

infected

9e59e07de288a01e8feb8e140ff18c2f2dbac94b6c90b29de054e0d9ce934079

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9e59e07de288a01e8feb8e140ff18c2f2dbac94b6c90b29de054e0d9ce934079
MD5 d09e06ded1d3158f478b6776cc70b4b5
SHA1 3c360966a4056febd130c0004ab639e58171b8da
SHA512 e9405bc4bb63343d119595336f75fd32dfbfdaa64ef3b4c40b6b4393dd144d06c0eddecbe8975cf9b5770fff854c2bceb8380346243e1ab527fc5360f73edef8
SSDEEP 3072:jxqZWRZaPkOQ3TjmTseesFqh+XxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwh:1qZoTjalqh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

RedLine payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

112018

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e283bb7023c01f111328e8db3b7f7807d279cdc4962b2b3685b7592d85622fa4

9e59e07de288a01e8feb8e140ff18c2f2dbac94b6c90b29de054e0d9ce934079

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

e283bb7023c01f111328e8db3b7f7807d279cdc4962b2b3685b7592d85622fa4

9e59e07de288a01e8feb8e140ff18c2f2dbac94b6c90b29de054e0d9ce934079

mscoree

dotnet