Overview

overview

10

Static

static

10

afda14bb01...f0.exe

windows7-x64

10

afda14bb01...f0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    afda14bb01d49f990c630fb905ad10f0.exe

  • Size

    95KB

  • Sample

    230228-pdcbdabc52

  • MD5

    afda14bb01d49f990c630fb905ad10f0

  • SHA1

    26e373fec80fe8a05292bd47151d6d80b732eda0

  • SHA256

    1cc7c37baa9861920ab2fc557e126a9f4ec10ff5ee23578c9f0857c4e7108a87

  • SHA512

    c929fe9e5e7edf3a9742a0c5455d7c91f4712498f760dd2ffeccb66bba63f5c73443f8893ee0f584610c8869447d12e6b38ed742cea3766c7ef91d0ced3b6e53

  • SSDEEP

    1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed23tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdvY

Score
10/10
redlinesectoprattest1discoveryinfostealerratspywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

test1

C2

20.226.37.161:6748

Targets

    • Target

      afda14bb01d49f990c630fb905ad10f0.exe

    • Size

      95KB

    • MD5

      afda14bb01d49f990c630fb905ad10f0

    • SHA1

      26e373fec80fe8a05292bd47151d6d80b732eda0

    • SHA256

      1cc7c37baa9861920ab2fc557e126a9f4ec10ff5ee23578c9f0857c4e7108a87

    • SHA512

      c929fe9e5e7edf3a9742a0c5455d7c91f4712498f760dd2ffeccb66bba63f5c73443f8893ee0f584610c8869447d12e6b38ed742cea3766c7ef91d0ced3b6e53

    • SSDEEP

      1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed23tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdvY

    Score
    10/10
    redlinesectoprattest1discoveryinfostealerratspywarestealertrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks