General

  • Target

    Tool.zip

  • Size

    9.3MB

  • MD5

    023deda4a94b8e12064acd04e8280cce

  • SHA1

    4cae6ce44f18692ec5c7c79d06af9cfd0962c3a1

  • SHA256

    66b28bfd0d3b0012f291627dad4bb74e650b54ae24a44906125527fad4d1ed62

  • SHA512

    4b2b4574e641c4ff3321858ab73702e376b8d1d36dbcbe4dd03727a27f7df5daa9bbfb0d51fa0793c4374900b431b021a98c3e47ea5ddf6eaa81d1b1121a8211

  • SSDEEP

    196608:2cvorfvywu/p1e9+iTQDtSiCz7c7ewD74SRxuYSKQF7YBykT/EAkk3:2oorfvaTOFTQpSis7c7l4MSbJaf3

Malware Config

Extracted

Family

redline

Botnet

telegramone

C2

163.5.160.27:51523

Signatures

  • RedLine payload 3 IoCs
  • Redline family
  • SectopRAT payload 3 IoCs
  • Sectoprat family
  • Detects Pyinstaller 1 IoCs
  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

Files

  • Tool.zip
    .zip
  • Tool/ConsoleApp1.deps.json
  • Tool/ConsoleApp1.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Tool/ConsoleApp1.pdb
  • Tool/ConsoleApp1.runtimeconfig.json
  • Tool/Mono.Cecil.Mdb.pdb
  • Tool/Mono.Cecil.Pdb.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Tool/Mono.Cecil.Rocks.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Tool/Mono.Cecil.Rocks.pdb
  • Tool/Tool.exe
    .exe windows:6 windows x64 arch:x64

    de41d4e0545d977de6ca665131bb479a


    Headers

    Imports

    Sections

  • Tool/how to use.txt
  • Tool/stub.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Tool/x64/Mono.Cecil.Mdb.pdb
  • Tool/x64/Mono.Cecil.Pdb.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Tool/x64/Mono.Cecil.Pdb.pdb
  • Tool/x64/Mono.Cecil.Rocks.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Tool/x64/Mono.Cecil.Rocks.pdb
  • Tool/x64/Mono.Cecil.pdb
  • Tool/x64/fix.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Tool/x64/fix1.exe
    .exe windows:5 windows x64 arch:x64

    1af6c885af093afc55142c2f1761dbe8


    Headers

    Imports

    Sections

  • clipper.pyc
  • Tool/x64/stub.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections