redline | JaffaCakes118_82b0b98a25e015b919bdcb864a933b76 | Triage

Sharing

General

Target

JaffaCakes118_82b0b98a25e015b919bdcb864a933b76
Size

104KB
MD5

82b0b98a25e015b919bdcb864a933b76
SHA1

a10447a1187dc4bb199660c0bb90f8f5d2a391e2
SHA256

de194096f78d36ae91049e8a9e06c6255d019920f99f21e28043e6a90bb92d62
SHA512

cd6e1533d8ef692a6b000089ade5655fcf576b7de6cd4d99acdfee622e484687dbc43238b1e868d91650f5cc5324c16e6251e36de0d585653d23209ad9ade7fe
SSDEEP

3072:pag0s5bLjlp5qg0mJvVNbk7gMZPV4IJvBZn9Z+:xTbLjlp5qg0ENraDdv+

Score

10^/10

roocrash v2.5 redline

Malware Config

Extracted

Family

redline

Botnet

RooCrash V2.5

C2

92.246.89.23:21869

Attributes

auth_value
de96507e639360f7a16601c22d57c808

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

JaffaCakes118_82b0b98a25e015b919bdcb864a933b76
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

5b:fc:c4:e1:52:bb:bd:98:41:91:8d:9d:55:48:fb:b7
Certificate

Issuer

CN=Richter,O=Stifling Allergists Inc.,C=63,1.2.840.113549.1.9.1=#0c1c6265736861646f77737069736361746f727940676d61696c2e636f6d

Not Before

15-10-2021 21:00

Not After

22-10-2031 21:00

Subject

CN=Richter,O=Stifling Allergists Inc.,C=63,1.2.840.113549.1.9.1=#0c1c6265736861646f77737069736361746f727940676d61696c2e636f6d

73:c6:6c:0f:62:2a:5c:c9:d0:4f:13:88:69:d6:eb:44:9d:fa:6d:f4
Signer

Actual PE Digest

73:c6:6c:0f:62:2a:5c:c9:d0:4f:13:88:69:d6:eb:44:9d:fa:6d:f4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ