redline | 34b2bc237e2393792827606a918c8172820f319ad4c69e8d806b878d99a8d3d9

General

Target

34b2bc237e2393792827606a918c8172820f319ad4c69e8d806b878d99a8d3d9
Size

51KB
MD5

fe8357daa1058ed6376464f5890cd1f3
SHA1

834a16b808cbdbfe214227bcb72bea916e9d6bc1
SHA256

34b2bc237e2393792827606a918c8172820f319ad4c69e8d806b878d99a8d3d9
SHA512

e8fea652393df62ba8d3500e33e1a4622ad61486009919471145d14adb3a86d7d07ceae86f271b8d3606f8a52db37e5b4093217e24ea006cec0d4e69f81e17bc
SSDEEP

1536:dzqji9WNuVHbtJMvGvdrLg8i9jzrY/27hORdx:dzZ6udbtJMGN3i9Pl4Rdx

Score

10^/10

luza redline

Family

redline

Botnet

luza

C2

176.113.115.145:4125

Attributes

RedLine payload 1 IoCs

resource	yara_rule
static1/unpack001/f933255bbb9705afc8bbd246d250fee905dcf5ecf578cb8b73b99613eccd1193	family_redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f933255bbb9705afc8bbd246d250fee905dcf5ecf578cb8b73b99613eccd1193

34b2bc237e2393792827606a918c8172820f319ad4c69e8d806b878d99a8d3d9
.zip

Password: infected
f933255bbb9705afc8bbd246d250fee905dcf5ecf578cb8b73b99613eccd1193
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ