redline | 36507bd53275572b5b021d0ad85310d6b87a5c0cef76ed3a5f653fe0ff365433

General

Target

36507bd53275572b5b021d0ad85310d6b87a5c0cef76ed3a5f653fe0ff365433
Size

43KB
MD5

4a099d32cb96f16cb3bc7d61daa02511
SHA1

2b854e5a53a7736eead79aa7b50de6995b4d4956
SHA256

36507bd53275572b5b021d0ad85310d6b87a5c0cef76ed3a5f653fe0ff365433
SHA512

2ca1db84105d09b338b81255b865261d5a28c5619dc5030f7f6dede52d9e32b931850852d868dafd8cddc05a200ce6a92cc0883a6defcbf451a195eabb3efc6b
SSDEEP

768:Jbsi0YXaDOTSwDIJJPz6SmaD4PfbMJnjjs9OlhQTDsa3JT7A+GktlgFcvemY8Z:KipaDi2J9z6ADefa49OITQa5T7xtlgFw

Score

10^/10

Family

redline

Botnet

cheat

C2

38.181.15.1:28294

RedLine payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/ef82cf52cbcd8a2539aa6340d008b8eecd80d053cbe7a158226fc5c9555e0cbf.exe	family_redline

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/ef82cf52cbcd8a2539aa6340d008b8eecd80d053cbe7a158226fc5c9555e0cbf.exe	family_sectoprat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/ef82cf52cbcd8a2539aa6340d008b8eecd80d053cbe7a158226fc5c9555e0cbf.exe

36507bd53275572b5b021d0ad85310d6b87a5c0cef76ed3a5f653fe0ff365433
.zip

Password: infected
ef82cf52cbcd8a2539aa6340d008b8eecd80d053cbe7a158226fc5c9555e0cbf.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ