Overview

overview

10

Static

static

10

80488bf5f3...e5.exe

windows7-x64

10

80488bf5f3...e5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1fd6d8d1c89f7ff74a36a409e31efffcbfe34bb13e9169524e3529a598254b7

  • Size

    43KB

  • MD5

    985439a6f909c44c71bd9ddf49017d63

  • SHA1

    16e1c711d26f2fd73947465e85cac2b9e038faf1

  • SHA256

    a1fd6d8d1c89f7ff74a36a409e31efffcbfe34bb13e9169524e3529a598254b7

  • SHA512

    b52f95366a398a1a0872d9f57ac55308da46cd49d8c572d4962a4b276a0ad028d71b382f67dcb9b05bbd50932ad16fd70efa9dde45cfd5487ca39634d37e0219

  • SSDEEP

    768:zQryGvYXH3yi/qnmfzsh3IXd5hxcnC6xjnFAUmxVn+lcSD4wkTiSxAg3e:UrvvYXCFmrsh32d+1jFAUWOD47TfAgu

Score
10/10
cheatredlinesectoprat

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

0.tcp.in.ngrok.io:17383

Signatures

  • RedLine payload 1 IoCs
  • Redline family
    redline
  • SectopRAT payload 1 IoCs
  • Sectoprat family
    sectoprat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • a1fd6d8d1c89f7ff74a36a409e31efffcbfe34bb13e9169524e3529a598254b7
    .zip

    Password: infected

  • 80488bf5f30ea2398ff207b9045a0e230aff2d052ea56156a0e96b57784dc0e5.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections