redline | d1af2776a0515fa6de91acb0a442048d[.]bin

General

Target
d1af2776a0515fa6de91acb0a442048d.bin
Size 43KB
Sample240516-dtldfaab56
SHA256 210291d06eedacada6ac5ae3dbc7e55d4b95057fa99406d0bd97570eb10a89d8
MD5 4ac4d9f638bd8941600c515f978e2a9d
SHA1 6f5f8cec903fc88deed23c7c2a7d54d138d9430d
SHA512 765cbd64d596a4344abba292217441dd109a8b8f784042db4b630fc4fd3cec9219a9c7025c090b62adfe90a3252d3a364159b5c427c214f94b52b24110db0c7e
SSDEEP 768:r6xsGTQproSSuM8pBfe8bGzxX3gZn9iIUBiiBHEQE7rIi+4GP6HwM1pLziS:CTYrlZM8pBftMX3gZ9iIUlREvHGiQMP5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cheat redline sectoprat

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

91.92.249.99:13359

Signatures

RedLine payload 1 IoCs

resource	yara_rule
static1/unpack001/972d6d5273ea9f4615e77d13fed4c51edd7ecc263112f1ce90f8847199b5a248.exe	family_redline

Redline family
redline

SectopRAT payload 1 IoCs

resource	yara_rule
static1/unpack001/972d6d5273ea9f4615e77d13fed4c51edd7ecc263112f1ce90f8847199b5a248.exe	family_sectoprat

Sectoprat family
sectoprat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/972d6d5273ea9f4615e77d13fed4c51edd7ecc263112f1ce90f8847199b5a248.exe

File Explorer

d1af2776a0515fa6de91acb0a442048d.bin

.zip 43KB
972d6d5273ea9f4615e77d13fed4c51edd7ecc263112f1ce90f8847199b5a248.exe

.exe 96KB

d1af2776a0515fa6de91acb0a442048d.bin

SHA256 210291d06eedacada6ac5ae3dbc7e55d4b95057fa99406d0bd97570eb10a89d8
MD5 4ac4d9f638bd8941600c515f978e2a9d
SHA1 6f5f8cec903fc88deed23c7c2a7d54d138d9430d
SHA512 765cbd64d596a4344abba292217441dd109a8b8f784042db4b630fc4fd3cec9219a9c7025c090b62adfe90a3252d3a364159b5c427c214f94b52b24110db0c7e
SSDEEP 768:r6xsGTQproSSuM8pBfe8bGzxX3gZn9iIUBiiBHEQE7rIi+4GP6HwM1pLziS:CTYrlZM8pBftMX3gZ9iIUlREvHGiQMP5
MD5 SHA1 SHA512 SSDEEP

Password

infected

972d6d5273ea9f4615e77d13fed4c51edd7ecc263112f1ce90f8847199b5a248.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 972d6d5273ea9f4615e77d13fed4c51edd7ecc263112f1ce90f8847199b5a248
MD5 d1af2776a0515fa6de91acb0a442048d
SHA1 78c76b53352d5eb9f2761d19a3063b203d369bad
SHA512 b96feea2fff7f32fe3ed27c55b414bd56a56a680e2f056c8ababa278e753de680eb17ce509c1665de8477b07499ecdf0671bb36dd6515df130d1d32c0982ab5c
SSDEEP 1536:DqsqmqnflbG6jejoigIi43Ywzi0Zb78ivombfexv0ujXyyed2CtQulgS6pE:xxw9Yi+zi0ZbYe1g0ujyzdGE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

RedLine payload
SectopRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

103438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d1af2776a0515fa6de91acb0a442048d.bin

972d6d5273ea9f4615e77d13fed4c51edd7ecc263112f1ce90f8847199b5a248.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

d1af2776a0515fa6de91acb0a442048d.bin

972d6d5273ea9f4615e77d13fed4c51edd7ecc263112f1ce90f8847199b5a248.exe

mscoree

dotnet