redline | JaffaCakes118_4d8f7f835e2f8856049b1c4941943075 | Triage

Sharing

General

Target

JaffaCakes118_4d8f7f835e2f8856049b1c4941943075
Size

102KB
MD5

4d8f7f835e2f8856049b1c4941943075
SHA1

8eef99e3164872b912967405009072e377d27a01
SHA256

81ea3ada2e2b9436589d9758eb2263483d175e36e6d4f113986ee3f479e36225
SHA512

30f8b0b489d1ae0546f61ad2d638a1097da1d577bf1dd711d3be0e5a635aff90b9f8477abf047c595807c3657020e88e2fd585fa5d5b533209df9644a8dea34c
SSDEEP

1536:WXL7P/eRELohhEeIKqDwGNw6iFX/eUGNiTxCqbM6vkJljgb9Kl0rfWref:WXL6RELHeiDwm4+N2cerk7IZr6ef

Score

10^/10

@addicatedd redline

Malware Config

Extracted

Family

redline

Botnet

@addicatedd

C2

62.182.156.24:12780

Attributes

auth_value
bb67ccc49d44343128ca161d7fe51029

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

JaffaCakes118_4d8f7f835e2f8856049b1c4941943075
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

16:b9:3b:65:61:ea:50:ae:49:a3:7b:e6:c1:84:29:a3
Certificate

Issuer

CN=Sunscreen,O=Slow Matutinal Inc.,C=MC,1.2.840.113549.1.9.1=#0c1d617263616e656e657373736569676e6f72616c40676d61696c2e636f6d

Not Before

13/10/2021, 21:00

Not After

20/10/2031, 21:00

Subject

CN=Sunscreen,O=Slow Matutinal Inc.,C=MC,1.2.840.113549.1.9.1=#0c1d617263616e656e657373736569676e6f72616c40676d61696c2e636f6d

4e:74:fe:24:c1:d9:14:01:43:14:b0:3a:f2:60:e9:a8:6a:e0:e9:e3
Signer

Actual PE Digest

4e:74:fe:24:c1:d9:14:01:43:14:b0:3a:f2:60:e9:a8:6a:e0:e9:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ