General

  • Target

    tmx.exe

  • Size

    300KB

  • MD5

    6260e34e7f5b518f3937628626dab6df

  • SHA1

    ce593f62cb0646c70a77c40f85fb547c09d94a1f

  • SHA256

    aad0d1425bb69662314d41ae1ed1b5ce5497d4c88cfa83a3b4e9a5fcfee0361f

  • SHA512

    a885773cfdcc8bdddeb0b27caaf51b7217b39886016519a858ad33e73417b19ecfe4b0cecde7ff9f91fa1b09d47db7c220f00643be843c910634267e5b3d892d

  • SSDEEP

    3072:2cZqf7D34dp/0+mAIkygIQQUgWsB1fA0PuTVAtkxze3RoeqiOL2bBOA:2cZqf7DIHnyjPB1fA0GTV8kkoL

Score
10/10

Malware Config

Extracted

Family

redline

Botnet

bin

C2

185.81.68.147:1912

Signatures

  • RedLine payload 1 IoCs
  • Redline family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • tmx.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections