Overview

overview

10

Static

static

10

5ecf0dade2...8e.exe

windows7-x64

10

5ecf0dade2...8e.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.zip
  • Size 43KB
  • Sample240402-nh2ldsgf99
  • SHA256 860654fef70c2666264610d36473c9c2b2772a3c8aa8f633630401dbd1f359ab
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cheatredlinesectoprat

Malware Config

Extracted

Family

  • redline

Botnet

  • cheat

C2

  • 0.tcp.eu.ngrok.io:18950

Signatures

  • RedLine payload 1 IoCs
  • Redline family
    redline
  • SectopRAT payload 1 IoCs
  • Sectoprat family
    sectoprat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.zip
    .zip 43KB
  • 5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe
    .exe 95KB

5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.zip

  • SHA256 860654fef70c2666264610d36473c9c2b2772a3c8aa8f633630401dbd1f359ab
  • MD5 SHA1 SHA512 SSDEEP
Password
infected