redline | c106958e5fba3a3eb8c94656bc6dedf6

Sharing

Copy URL

Twitter E-mail

General

Target

c106958e5fba3a3eb8c94656bc6dedf6
Size

105KB
MD5

c106958e5fba3a3eb8c94656bc6dedf6
SHA1

3df0b7c54244cb167707a2a9825e2e28699d272f
SHA256

b2c5577e8c882eee0be28cb16350b7aa48c3052d410d421da4a9620a8c86807d
SHA512

2597a9a8b0cf97780279a8627fa6e862f0cf974ff31c8a9f9a0b58f1bb6d845891e24075e1d76c527a11b9dae2eda7c61d90b29af2580ee01ede723e60b885c0
SSDEEP

1536:wo6aGr2CT0jE68c30H6lsf+oRxv7zauiw2eLgbue7vtuvNyAsd3letx5REnG6WAD:wdxiCT0+aWVe5DeM3tulydd4NW9apU3

Score

10^/10

first_7.5k redline sectoprat

Malware Config

Extracted

Family

redline

Botnet

FIRST_7.5k

45.14.49.200:27625

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

SectopRAT payload 1 IoCs

resource	yara_rule
sample	family_sectoprat

Sectoprat family
sectoprat

Files

c106958e5fba3a3eb8c94656bc6dedf6
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:c6:db:ce:3d:54:99:f6:5d:9d:f1:6e:90:07:46:5d
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

18-07-2021 00:00

Not After

18-07-2022 23:59

Subject

CN=AMCERT\,LLC,O=AMCERT\,LLC,L=Yerevan,C=AM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:0c:8f:c7:5a:cd:e3:3c:34:5e:b3:bf:f6:f5:8f:0f:6f:61:ee:be
Signer

Actual PE Digest

0a:0c:8f:c7:5a:cd:e3:3c:34:5e:b3:bf:f6:f5:8f:0f:6f:61:ee:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

25:c6:db:ce:3d:54:99:f6:5d:9d:f1:6e:90:07:46:5dCertificate

Extended Key Usages

Key Usages

0a:0c:8f:c7:5a:cd:e3:3c:34:5e:b3:bf:f6:f5:8f:0f:6f:61:ee:beSigner

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 96KB - Virtual size: 95KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 12B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

25:c6:db:ce:3d:54:99:f6:5d:9d:f1:6e:90:07:46:5d
Certificate

0a:0c:8f:c7:5a:cd:e3:3c:34:5e:b3:bf:f6:f5:8f:0f:6f:61:ee:be
Signer

.text
Size: 96KB - Virtual size: 95KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 12B