Files named NetFx20.exe

31.132.165.232 · NetFx20.exe

/pankova/Работа/АВТОКАД_2013/3rdParty/x86/NET/2/

Russia · JSC ER-Telecom Holding

Yara detect_Redline_Stealer From AbuseCH by Varp0s

Download archived sample
The password is "infected"

SHA1: a3625c59d7a2995fb60877b5f5324892a1693b2a
SHA256: 46693d9b74d12454d117cc61ff2e9481cabb100b4d74eb5367d3cf88b89a0e71
application/octet-stream
22.42MB
2010-10-10 15:58:36 +0000 UTC
31.132.165.232 · NetFx20.exe

/pankova/Работа/АВТОКАД_2013/3rdParty/x64/NET/2/

Russia · JSC ER-Telecom Holding

Yara detect_Redline_Stealer From AbuseCH by Varp0s

Download archived sample
The password is "infected"

SHA1: e59cca309463a5d98daeaada83d1b05fed5126c5
SHA256: 7ea86dca8eeaedcaa4a17370547ca2cea9e9b6774972b8e03d2cb1fb0e798669
application/octet-stream
45.20MB
2010-10-10 16:06:56 +0000 UTC
31.132.165.232 · NetFx20.exe

/pankova/Работа/АВТОКАД_2013/3rdParty/x86/NET/2/

Russia · JSC ER-Telecom Holding

Yara detect_Redline_Stealer From AbuseCH by Varp0s

Download archived sample
The password is "infected"

SHA1: a3625c59d7a2995fb60877b5f5324892a1693b2a
SHA256: 46693d9b74d12454d117cc61ff2e9481cabb100b4d74eb5367d3cf88b89a0e71
application/octet-stream
22.42MB
2010-10-10 15:58:36 +0000 UTC
31.132.165.232 · NetFx20.exe

/pankova/Работа/АВТОКАД_2013/3rdParty/x64/NET/2/

Russia · JSC ER-Telecom Holding

Yara detect_Redline_Stealer From AbuseCH by Varp0s

Download archived sample
The password is "infected"

SHA1: e59cca309463a5d98daeaada83d1b05fed5126c5
SHA256: 7ea86dca8eeaedcaa4a17370547ca2cea9e9b6774972b8e03d2cb1fb0e798669
application/octet-stream
45.20MB
2010-10-10 16:06:56 +0000 UTC