General

  • Target

    Setup 2.1.zip

  • Size

    22.5MB

  • MD5

    3c1e09e71528975ccb05386130771fd4

  • SHA1

    76eb16c5344306bbccd4d802c3c3dce1b7d6c2e2

  • SHA256

    02bed981dce70b947d72c304a3f2e1cbdee963c315779d5717769f88c8166447

  • SHA512

    832ca2979b8364666f84f41ad7f06c863016ac2172c9f97d461162aef87478b58a13cd4d571521ab2a7265a54499043738c6366583b3f1647d78f94563259eff

  • SSDEEP

    393216:Wh71HxcV7gxN7U9z/w/p9XMWrl05YdycEB7Qrdx2V9+fYNpEnMxI8MGAf6yfL+4i:GJCyxNQ9s/paw0idgAdxQwfYPEGZMG8q

Score
10/10

Malware Config

Signatures

  • RedLine payload 1 IoCs
  • Redline family
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • Setup 2.1.zip
    .zip

    Password: 1234

  • Setup 2.1.exe
    .exe windows x86

    Password: 1234

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • data.bin
  • libEGL.dll
  • libeay32.dll
    .dll windows x86

    Password: 1234

    ae15fc51ee87015af2fc029c06e0c950


    Headers

    Imports

    Exports

    Sections

  • libgcc_s_dw2-1.dll
    .dll windows x86

    Password: 1234

    5a18b12e92e997d2ca370de96393cb7f


    Headers

    Imports

    Exports

    Sections

  • libwinpthread-1.dll
    .dll windows x86

    Password: 1234

    2a44931aaa0f249729076816ea33fffb


    Headers

    Imports

    Exports

    Sections

  • msvcp100.dll
    .dll windows x86

    Password: 1234

    7a0d9f66efd1839f136ca6896fa52dfa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcp140.dll
    .dll windows x86

    Password: 1234

    6dbd7763e94344402d4206b7bab40e1f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr100.dll
    .dll windows x86

    Password: 1234

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • opengl32sw.dll