redline | d6fabeb016a5ef8b65a634158d6e35ae | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d6fabeb016a5ef8b65a634158d6e35ae
Size

116KB
MD5

d6fabeb016a5ef8b65a634158d6e35ae
SHA1

49329afd603e47ae17846931ae354084c42d1419
SHA256

9ee47f77f90493e4d5b2bf11a5a68129c37ca74b708dd52b2c289ecf7833145e
SHA512

1812c3fe1d0839bc8bbf3d9d0b3f1a2e29e08a569fd4ecc9dfc2a31e7b66b756647a72e0e6997bfb1e7ae9d9f972a85c4cdafa382910f57e0bb3d3e60b9b78e8
SSDEEP

1536:DteNn+bYKCFUnUMKnONAJqjbuRtd2nhuyq/dyVAdbknEPG6qTaoignVU:ZeSAvONAJoY2nYyOdygkE63+

Score

10^/10

hammerfall redline sectoprat

Malware Config

Extracted

Family

redline

Botnet

Hammerfall

C2

45.67.228.114:32977

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

SectopRAT payload 1 IoCs

resource	yara_rule
sample	family_sectoprat

Sectoprat family
sectoprat

Files

d6fabeb016a5ef8b65a634158d6e35ae
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

35:43:37:ff:41:bf:7e:9e:4e:3b:3b:22:dd:70:ac:d8
Certificate

Issuer

CN=Limper,O=Digitated Skelters Inc.,C=SN,1.2.840.113549.1.9.1=#0c196c696d7065726d656c61746f6e696e40676d61696c2e636f6d

Not Before

23/08/2021, 21:00

Not After

30/08/2031, 21:00

Subject

CN=Limper,O=Digitated Skelters Inc.,C=SN,1.2.840.113549.1.9.1=#0c196c696d7065726d656c61746f6e696e40676d61696c2e636f6d

28:ab:68:89:af:e7:2d:db:9b:33:6c:24:1b:fe:1f:88:9f:5b:20:fb
Signer

Actual PE Digest

28:ab:68:89:af:e7:2d:db:9b:33:6c:24:1b:fe:1f:88:9f:5b:20:fb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ