General

  • Target

    4999896400822272.zip

  • Size

    14.7MB

  • MD5

    36e895cac68782276f49144d8904f79e

  • SHA1

    411476265cdb80d2119ae49c34c6700a36577657

  • SHA256

    f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113

  • SHA512

    db7e7997e7017fc083b067aa9a610be84e425a5a562829a02dd3650b0dcf42a4ced706a69d27b7e86ce503558b13f9791b107f4281b0f4845e1d83a874e24550

Score
10/10

Malware Config

Extracted

Family

redline

Botnet

1.22

C2

95.211.185.27:42097

Signatures

  • RedLine Payload 1 IoCs
  • Redline family
  • Socelars Payload 1 IoCs
  • Socelars family
  • autoit_exe 1 IoCs

    AutoIT scripts compiled to PE executables.

Files

  • 4999896400822272.zip
    .zip

    Password: infected

  • 1038157f6d8e0bc282524fefbc0825825ea32d47b23072bae22534c6c9803e3d
    .zip
  • 6c5db6dce13ded4e0e6c7e9a526b063e.exe
    .exe windows x86


  • DusBrowserInst.exe
    .exe windows x86


  • IDWCH2.exe
    .exe windows x86


  • Litever01.exe
    .exe windows x86


  • NAN.exe
    .exe windows x86


  • anyname.exe
    .exe windows x86


  • app.exe
    .exe windows x86


  • askinstall50.exe
    .exe windows x86


  • farlab_setup.exe
    .exe windows x86


  • inst002.exe
    .exe windows x86


  • jamesnew.exe
    .exe windows x86


  • justdezine.exe
    .exe windows x86


  • md3_3kvm.exe
    .exe windows x86


  • mixseven.exe
    .exe windows x86


  • redcloud.exe
    .exe windows x86


  • udptest.exe
    .exe windows x86


  • vguuu.exe
    .exe windows x64