redline | 12e1259f06fdfa6edf1ec8b720bc1396ded2fc4c4d433ffde9ca5ad0cf0e51ab[.]exe | Triage

Sharing

General

Target

12e1259f06fdfa6edf1ec8b720bc1396ded2fc4c4d433ffde9ca5ad0cf0e51ab.exe
Size

104KB
MD5

6eabfaaa9b900c96a22d2ba41d49e76a
SHA1

324745655b9c18a93b198c0121ccfdaf16986211
SHA256

12e1259f06fdfa6edf1ec8b720bc1396ded2fc4c4d433ffde9ca5ad0cf0e51ab
SHA512

7a5852c0e35961a587a9edaf23f043d7df9cb4d550830a46366c883ec3ba6736e06ae5aeeaa96d643258336c30ad646aef04444f964fb5672585793f60d446b1
SSDEEP

3072:OZUKsQbLjlp5qEWqzTjAZ+k7nGjPzhIJvA9C:FwbLjlp5qEWgAZbf+w

Score

10^/10

@kissyt redline

Malware Config

Extracted

Family

redline

Botnet

@kissyt

C2

45.137.190.237:27973

Attributes

auth_value
90a7f02f0cbc48c0c8632519fbd10c4b

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

12e1259f06fdfa6edf1ec8b720bc1396ded2fc4c4d433ffde9ca5ad0cf0e51ab.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

4e:e6:a1:b2:21:74:58:9a:43:68:65:7d:c3:8b:e1:d4
Certificate

Issuer

CN=Perdured,O=Gravlax Normals Inc.,C=IE,1.2.840.113549.1.9.1=#0c1b6b65726e656c6c6564706f7374706f736540676d61696c2e636f6d

Not Before

15-10-2021 21:00

Not After

22-10-2031 21:00

Subject

CN=Perdured,O=Gravlax Normals Inc.,C=IE,1.2.840.113549.1.9.1=#0c1b6b65726e656c6c6564706f7374706f736540676d61696c2e636f6d

d0:07:74:bd:7a:62:49:26:b4:35:46:02:44:51:09:db:72:0e:84:fe
Signer

Actual PE Digest

d0:07:74:bd:7a:62:49:26:b4:35:46:02:44:51:09:db:72:0e:84:fe

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ