redline | 58411877c7e0956f18eefdb39ceaf9f191018e5a5910b081ba2056df063a85af | Triage

Sharing

General

Target

58411877c7e0956f18eefdb39ceaf9f191018e5a5910b081ba2056df063a85af
Size

602KB
MD5

4273c611ae8e12f20f481819355e700b
SHA1

e9b253fbdaccac985e6caa3c58b7e63879035360
SHA256

58411877c7e0956f18eefdb39ceaf9f191018e5a5910b081ba2056df063a85af
SHA512

c14c0db537fc4de38cfd4e627432e9ee7e2736caa7e6d92ab1336c6f344fc9b4b15474c7159ebfc729c10ca79dad5f10fb5983f3895c478e5cad71c7f64c2705
SSDEEP

12288:45/dLIlbLM4u7WBCR+IqtUvp+/v3ip8f/bJgO3EtRiqHxrwcPJZhlKO8YRUysUql:47X4u7WBaed/

Score

10^/10

zzz redline

Malware Config

Extracted

Family

redline

Botnet

ZZZ

C2

5.42.92.74:7175

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
58411877c7e0956f18eefdb39ceaf9f191018e5a5910b081ba2056df063a85af

Files

58411877c7e0956f18eefdb39ceaf9f191018e5a5910b081ba2056df063a85af
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

B8pD.MV
Size: 222KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ