Overview

overview

10

Static

static

10

Elsify.exe

windows7-x64

10

Elsify.exe

windows10-2004-x64

10

Mono.Cecil.Mdb.dll

windows7-x64

1

Mono.Cecil.Mdb.dll

windows10-2004-x64

1

Mono.Cecil.Pdb.dll

windows7-x64

1

Mono.Cecil.Pdb.dll

windows10-2004-x64

1

Mono.Cecil.dll

windows7-x64

1

Mono.Cecil.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    772abd60da2fe5291ad41246011d7bcc83f8f8c994e03a9dd711a8b6c8990f89

  • Size

    251KB

  • MD5

    c6e8778ed52a20e4fab9469e72fa7846

  • SHA1

    55286bdb34547d39c3cb39a2503acc2418361415

  • SHA256

    772abd60da2fe5291ad41246011d7bcc83f8f8c994e03a9dd711a8b6c8990f89

  • SHA512

    1192e05b757a0431ffc59288ea6cc06d2f3de5e608f0f078937b7566fc6695dcecf1ca043873367b3cb7dae1b226d6c9a742c24d548f75c61ce55e604b4a19f9

  • SSDEEP

    6144:ooW7Z2JXt8xvDWrrGn8ohKrpHoAVoEdVpS/BLGgyrr:z9ovwuEFaEn4v+r

Score
10/10
wcmfr5xkm66wkyvkredlinesectoprat

Malware Config

Extracted

Family

redline

Botnet

wcmFr5xKM66WkyVK

C2

45.42.45.232:53637

Signatures

  • RedLine payload 1 IoCs
  • Redline family
    redline
  • SectopRAT payload 1 IoCs
  • Sectoprat family
    sectoprat
  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • 772abd60da2fe5291ad41246011d7bcc83f8f8c994e03a9dd711a8b6c8990f89
    .rar
  • Elsify.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Logo.ico
  • Mono.Cecil.Mdb.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Mono.Cecil.Pdb.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Mono.Cecil.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections