redline | 51297ca658f66c270f4aeeb24c1cf2f4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

51297ca658f66c270f4aeeb24c1cf2f4
Size

116KB
MD5

51297ca658f66c270f4aeeb24c1cf2f4
SHA1

397f29200d65eb4b69ee1d66a8deab4b9ae2f505
SHA256

9ab78ca17475bc6f79aa45804e6fa1c5081e95126ca00b8264b20c24cde6607c
SHA512

c5bf5bc31fbdc041d94865250e24d157a2ed4cf3a73e033758caab13cb3a474cea2b5c1b4ba451e3efc00a1f155addc69874ca19e7055e9e2c0e9b80c38c4881
SSDEEP

3072:EeMnxxzowwwwwwwwwwwZw1ww4uvGnPyOdHTkEqVCI:ieUy4Vg

Score

10^/10

install redline sectoprat

Malware Config

Extracted

Family

redline

Botnet

install

C2

185.167.97.37:30904

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

SectopRAT payload 1 IoCs

resource	yara_rule
sample	family_sectoprat

Sectoprat family
sectoprat

Files

51297ca658f66c270f4aeeb24c1cf2f4
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

2f:b6:71:2c:79:0b:4a:8b:46:cf:2f:e4:00:fa:83:79
Certificate

Issuer

CN=Yoicked,O=Eyrir Swilling Inc.,C=HC,1.2.840.113549.1.9.1=#0c1b63726962726f736573636166666f6c647340676d61696c2e636f6d

Not Before

24/08/2021, 21:00

Not After

31/08/2031, 21:00

Subject

CN=Yoicked,O=Eyrir Swilling Inc.,C=HC,1.2.840.113549.1.9.1=#0c1b63726962726f736573636166666f6c647340676d61696c2e636f6d

6f:52:9a:16:9b:b8:04:4e:1c:49:57:34:51:8b:bc:51:43:36:b2:e2
Signer

Actual PE Digest

6f:52:9a:16:9b:b8:04:4e:1c:49:57:34:51:8b:bc:51:43:36:b2:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ