redline | ca34336e7af35641779eb9cd884f907c

Sharing

Copy URL Twitter E-mail

General

Target

ca34336e7af35641779eb9cd884f907c
Size

103KB
MD5

ca34336e7af35641779eb9cd884f907c
SHA1

b0831088e3c27ebd95198949398dca53afd123d7
SHA256

85736812c43f47e1aaffd52013c916432cdf2481746c2fa2ef219fa572e2fb1f
SHA512

b2c704057b516ea9f7127faf356265fdfbcfe400c9153f85d84fa0633e73786260617690822c5cf0df82e485aefcbca78dc15214b14eb1ba12d1574b21702366
SSDEEP

1536:I3LNmocO2I5C1FW8d63AbSyJFMfTQmbfexvAuvLyyedQg3nqCxXsEGG6ijoigYM1:Ixmoc3V6gSyJ+T9gAuTyzd0SnDM1

Score

10^/10

@testokms redline sectoprat

Malware Config

Extracted

Family

redline

Botnet

@testokms

137.74.76.180:52028

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

SectopRAT payload 1 IoCs

resource	yara_rule
sample	family_sectoprat

Sectoprat family
sectoprat

Files

ca34336e7af35641779eb9cd884f907c
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bc:6a:18:12:e0:01:36:24:69:54:11:08:97:3b:bd:52
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

16/06/2021, 00:00

Not After

16/06/2022, 23:59

Subject

CN=AMCERT\,LLC,O=AMCERT\,LLC,L=Yerevan,C=AM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a6:4f:de:0a:9d:73:db:cd:94:0f:bd:40:a1:35:67:cf:93:4b:19:f9
Signer

Actual PE Digest

a6:4f:de:0a:9d:73:db:cd:94:0f:bd:40:a1:35:67:cf:93:4b:19:f9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

bc:6a:18:12:e0:01:36:24:69:54:11:08:97:3b:bd:52Certificate

Extended Key Usages

Key Usages

a6:4f:de:0a:9d:73:db:cd:94:0f:bd:40:a1:35:67:cf:93:4b:19:f9Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 94KB - Virtual size: 93KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 12B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

bc:6a:18:12:e0:01:36:24:69:54:11:08:97:3b:bd:52
Certificate

a6:4f:de:0a:9d:73:db:cd:94:0f:bd:40:a1:35:67:cf:93:4b:19:f9
Signer

.text
Size: 94KB - Virtual size: 93KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 12B