Overview

overview

10

Static

static

10

06979f859b...b2.exe

windows7-x64

10

06979f859b...b2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    06979f859be403c6e94b16452365fbeccbc0f85b7c6e40ba41c3460856027db2.exe

  • Size

    95KB

  • MD5

    034669b9e2200fec6a20f622acf4dbd1

  • SHA1

    510b27931b6f598b997298f4ae791848a3be9ad3

  • SHA256

    06979f859be403c6e94b16452365fbeccbc0f85b7c6e40ba41c3460856027db2

  • SHA512

    965b41536e7c53a10c0f1cc1497759d39ba2b5114018094092ca148cb9a599c4721795aa9af7edad180f78b94ad96aba56fce629a9299107136e40ec3cf212a3

  • SSDEEP

    1536:5qsCOqJGlbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2PteulgS6p8l:X1uOYj+zi0ZbYe1g0ujyzdL8

Score
10/10
hackusredlinesectoprat

Malware Config

Extracted

Family

redline

Botnet

Hackus

C2

0.tcp.ngrok.io:18233

Signatures

  • RedLine payload 1 IoCs
  • Redline family
    redline
  • SectopRAT payload 1 IoCs
  • Sectoprat family
    sectoprat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 06979f859be403c6e94b16452365fbeccbc0f85b7c6e40ba41c3460856027db2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections