redline | 9850a146e69faa57ef437bf9cb7a781a

Sharing

Copy URL

Twitter E-mail

General

Target

9850a146e69faa57ef437bf9cb7a781a
Size

368KB
MD5

9850a146e69faa57ef437bf9cb7a781a
SHA1

2bfa93d24a6772db3f760268a65c7113d3113114
SHA256

c17e4fa4530f011bef743905ab7e5e176a6e30f0b92ffcc7f27ed2e40d89f3f0
SHA512

ca993da6a830464d82e395ddb60579117b42bccce22785ae81b7f428c7b4297e4dc104fc57a5fdcde3feabfec174748e84dc6fb24cf59c24717aa734474ab8f5
SSDEEP

3072:ei86Adib5AYQzaiO3PulyddHsv/MJeGVMUUs:N7AdOiYz4yYwemUs

Score

10^/10

35 redline sectoprat

Malware Config

Extracted

Family

redline

Botnet

45.144.29.222:17722

Signatures

RedLine payload 1 IoCs

Processes:

resource yara_rule

sample family_redline
Redline family
redline
SectopRAT payload 1 IoCs

Processes:

resource yara_rule

sample family_sectoprat
Sectoprat family
sectoprat

resource	yara_rule
sample	family_redline

resource	yara_rule
sample	family_sectoprat

Files

9850a146e69faa57ef437bf9cb7a781a
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:c6:db:ce:3d:54:99:f6:5d:9d:f1:6e:90:07:46:5d
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

18-07-2021 00:00

Not After

18-07-2022 23:59

Subject

CN=AMCERT\,LLC,O=AMCERT\,LLC,L=Yerevan,C=AM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d2:d1:32:08:94:d4:71:c1:fd:4b:55:a2:7d:c8:7e:e2:48:6c:b9:07
Signer

Actual PE Digest

d2:d1:32:08:94:d4:71:c1:fd:4b:55:a2:7d:c8:7e:e2:48:6c:b9:07

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 265KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

25:c6:db:ce:3d:54:99:f6:5d:9d:f1:6e:90:07:46:5dCertificate

Extended Key Usages

Key Usages

d2:d1:32:08:94:d4:71:c1:fd:4b:55:a2:7d:c8:7e:e2:48:6c:b9:07Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 96KB - Virtual size: 95KB

.rsrc Size: 265KB - Virtual size: 264KB

.reloc Size: 1024B - Virtual size: 12B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

25:c6:db:ce:3d:54:99:f6:5d:9d:f1:6e:90:07:46:5d
Certificate

d2:d1:32:08:94:d4:71:c1:fd:4b:55:a2:7d:c8:7e:e2:48:6c:b9:07
Signer

.text
Size: 96KB - Virtual size: 95KB

.rsrc
Size: 265KB - Virtual size: 264KB

.reloc
Size: 1024B - Virtual size: 12B