redline | bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6[.]exe

General

Target

bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6.exe
Size

95KB
MD5

735c15c37831cdc319c03f4f7971da49
SHA1

166949cdb534d97c564adc27f297406a4bf38204
SHA256

bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6
SHA512

3c9227b9472d7840f74363b9801756923de56fcff5349f6e287206531c0da4717a9de520322d122bef30f7b66fdbeaac715ebbe64389de89b1c7d5e832e87ac8
SSDEEP

1536:9qskXqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2OtmulgS6pY:rCgzWHY3+zi0ZbYe1g0ujyzd6Y

Score

10^/10

Family

redline

Botnet

exodus

C2

94.156.8.229:1334

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

RedLine payload 1 IoCs

Processes:

resource yara_rule

sample family_redline
Redline family
redline
SectopRAT payload 1 IoCs

Processes:

resource yara_rule

sample family_sectoprat
Sectoprat family
sectoprat

resource	yara_rule
sample	family_redline

resource	yara_rule
sample	family_sectoprat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6.exe