redline | ebc21056b18af1cdb12f3319364933fa9c49bcb474fe8cd03e37ca6b069e0902[.]exe | Triage

Sharing

General

Target

ebc21056b18af1cdb12f3319364933fa9c49bcb474fe8cd03e37ca6b069e0902.exe
Size

217KB
MD5

43d2fa77112ba62e4da7d7505660279e
SHA1

c7957d3bd25e6c89569789cf6657a562539383d1
SHA256

ebc21056b18af1cdb12f3319364933fa9c49bcb474fe8cd03e37ca6b069e0902
SHA512

fb93b48dd08407c8294938e5fc63546193a7e946cbe80f0c60a8c936978d3036221a7294af53ca66bc08309af92d93431a2ec081dce5881ba9489690610eec1d
SSDEEP

3072:Aj+7RiC0VRWIlJmkM9LhujQUeKADufwPkYnYYewy:F7Z1hlUeKh6jy

Score

10^/10

redline

Malware Config

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

ebc21056b18af1cdb12f3319364933fa9c49bcb474fe8cd03e37ca6b069e0902.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

1d:74:42:71:d2:2d:d9:bb:4a:e5:71:33:33:51:15:4c
Certificate

Issuer

CN=Nagas,O=Lupuline Ratherest Inc.,C=U5,1.2.840.113549.1.9.1=#0c1b736176617465736272656563686c65737340676d61696c2e636f6d

Not Before

14-10-2021 21:00

Not After

21-10-2031 21:00

Subject

CN=Nagas,O=Lupuline Ratherest Inc.,C=U5,1.2.840.113549.1.9.1=#0c1b736176617465736272656563686c65737340676d61696c2e636f6d

8f:58:46:ad:58:af:61:80:de:35:fd:4a:e7:4e:d4:00:d5:0d:dd:ba
Signer

Actual PE Digest

8f:58:46:ad:58:af:61:80:de:35:fd:4a:e7:4e:d4:00:d5:0d:dd:ba

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ