Overview

overview

10

Static

static

10

2800-120-0...ry.exe

windows7-x64

2800-120-0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2800-120-0x0000000000DC0000-0x0000000001238000-memory.dmp

  • Size

    4.5MB

  • MD5

    06b8f3ed6ce4c5402eeff9c03bb6f67d

  • SHA1

    a48c8d86e3b2f9247f148b9306dd6e76f3fbe498

  • SHA256

    0abaf3427aada6e16e06b08f07c188bfcdf9fd8b951b64e05bbcdbf914303b78

  • SHA512

    ad8d2d326586a7527b269537a24735d30f32154a22f9b96b07e74bdb858769d0192f2d123e90b5e166084232beb2772fe8cf04ab6ddd8c0d73c374b5176f5555

  • SSDEEP

    49152:KRrBR6Yu++lzk6qJBFSqVv4t6xUZJPqyhWzXRU6l3rIDUmGhgscIa:KRNR6Yu+H6qBnVv4tPFFIlcDUBa/I

Score
10/10
cheatsectopratredline

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

103.84.89.222:33791

Signatures

  • Redline family
    redline
  • SectopRAT payload 1 IoCs
  • Sectoprat family
    sectoprat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2800-120-0x0000000000DC0000-0x0000000001238000-memory.dmp
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections