General
-
Target
aec6496145753c7507b17d76d70dbab8b75d0a547194375ee2bcd66b9ebc99a3
-
Size
95KB
-
MD5
bf34de529a120cc9a93664aae4bd83c3
-
SHA1
f557cd615fd252a2e312aa0baa61f3360e017728
-
SHA256
aec6496145753c7507b17d76d70dbab8b75d0a547194375ee2bcd66b9ebc99a3
-
SHA512
10f3dbb6c48823305a494159f3599fd7c7868dc515fa6907c3a8f547c1554ab837a8200b4c3c0033fc0fa8c5b2c0daf2bc998446316747a3692ab23cb93a648b
-
SSDEEP
1536:5qsCOqJGlbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2iteulgS6p8l:X1uOYj+zi0ZbYe1g0ujyzdK8
Malware Config
Extracted
redline
crypto
85.217.144.184:38329
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
SectopRAT payload 1 IoCs
resource yara_rule sample family_sectoprat -
Sectoprat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aec6496145753c7507b17d76d70dbab8b75d0a547194375ee2bcd66b9ebc99a3
Files
-
aec6496145753c7507b17d76d70dbab8b75d0a547194375ee2bcd66b9ebc99a3.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ