sectoprat | 0f266c3e2fd1fc4545e31433198f51c7

General

Target
0f266c3e2fd1fc4545e31433198f51c7
Size 95KB
Sample241110-bbqjbswcml
SHA256 8a9e0224621fa10771a71cdc141d7f27a05c8e60067e5adc32d89571e5d05d13
MD5 0f266c3e2fd1fc4545e31433198f51c7
SHA1 6b1b4b7a3f5c1730cdeaf5c28c5dd74583932c47
SHA512 258c6f26da53da886c32f11bce58b219fb017e585f52df37857216574f4eca271d6d11cc34ab0d41180f3c338225c348ade3216a88cfde4694f34a7dd6639b7f
SSDEEP 1536:AqsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2d3tmulgS6p8lt:uEwiYj+zi0ZbYe1g0ujyzdp8P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cheat sectoprat redline

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

0.tcp.ngrok.io:10680

Signatures

RedLine payload 1 IoCs

resource	yara_rule
static1/unpack001/build.exe	family_redline

Redline family
redline

SectopRAT payload 2 IoCs

resource	yara_rule
sample	family_sectoprat
static1/unpack001/build.exe	family_sectoprat

Sectoprat family
sectoprat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/build.exe

File Explorer

0f266c3e2fd1fc4545e31433198f51c7

.zip 95KB
build.exe

.exe 95KB

0f266c3e2fd1fc4545e31433198f51c7

SHA256 8a9e0224621fa10771a71cdc141d7f27a05c8e60067e5adc32d89571e5d05d13
MD5 0f266c3e2fd1fc4545e31433198f51c7
SHA1 6b1b4b7a3f5c1730cdeaf5c28c5dd74583932c47
SHA512 258c6f26da53da886c32f11bce58b219fb017e585f52df37857216574f4eca271d6d11cc34ab0d41180f3c338225c348ade3216a88cfde4694f34a7dd6639b7f
SSDEEP 1536:AqsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2d3tmulgS6p8lt:uEwiYj+zi0ZbYe1g0ujyzdp8P
MD5 SHA1 SHA512 SSDEEP

SectopRAT payload

build.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 6db259d45bbd76c7ced06f0eede1f015b2d7357d39252e48e13345d70ed02bf8
MD5 4fc7b065cb4c278d320f5b7d4eed60ae
SHA1 301a30fe5e355dc1196bef16165a0fee809d1122
SHA512 201cd36cd8a2472ac1ae8be9b06adfc143c0c74200cca2d6b02eb4bc606d88838a32d65d021d9e45e263738c0c9c4c13ebc9aa7c11e07e6dd3403347de67e1aa
SSDEEP 1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2d3tmulgS6p8l:XEwiYj+zi0ZbYe1g0ujyzdp8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

RedLine payload
SectopRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

103230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

0f266c3e2fd1fc4545e31433198f51c7

build.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

0f266c3e2fd1fc4545e31433198f51c7

build.exe

mscoree

dotnet