redline | 10ef944af097dfefef2b1e3b26fd2017[.]exe | Triage

Sharing

General

Target

10ef944af097dfefef2b1e3b26fd2017.exe
Size

116KB
MD5

10ef944af097dfefef2b1e3b26fd2017
SHA1

cc8f9e6e0a6e9841f224adc679161b551cf50fa3
SHA256

6d478f93063ce6433c9962bb6a1ade13344f279ee793dc4098ab4b352c830d9f
SHA512

8cc53dbc0662a90a9ba039736901682ed69171723769f580e075fcda0d4cc40c69bbd15a6829cd5563ae37a7745468e62510654b883cb556ae3fcd5236b5b0c1
SSDEEP

1536:4e16bb1WyVc1vZKnuZvMpHejbuRGdEnhtyq/d3VNdbknEzG6qTaoiglnHm+Ebv:ppBKcvMpcvEnvyOd3BkEm1G+Y

Score

10^/10

installs redline sectoprat

Malware Config

Extracted

Family

redline

Botnet

INSTALLS

C2

95.215.205.85:48425

Signatures

RedLine payload 1 IoCs

Processes:

resource yara_rule

sample family_redline
Redline family
redline
SectopRAT payload 1 IoCs

Processes:

resource yara_rule

sample family_sectoprat
Sectoprat family
sectoprat

Files

10ef944af097dfefef2b1e3b26fd2017.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

60:39:ae:3d:b8:17:63:ab:4d:c1:be:9c:b8:96:d9:ca
Certificate

Issuer

CN=Commune,O=Unbedimmed Bursar Inc.,C=CZ,1.2.840.113549.1.9.1=#0c1d6d69736f72646572656472696e67736964657340676d61696c2e636f6d

Not Before

30-08-2021 21:00

Not After

06-09-2031 21:00

Subject

CN=Commune,O=Unbedimmed Bursar Inc.,C=CZ,1.2.840.113549.1.9.1=#0c1d6d69736f72646572656472696e67736964657340676d61696c2e636f6d

7a:a2:73:2c:7f:f0:3f:02:ab:a0:28:c9:44:99:ed:b5:89:b0:f4:52
Signer

Actual PE Digest

7a:a2:73:2c:7f:f0:3f:02:ab:a0:28:c9:44:99:ed:b5:89:b0:f4:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ