Overview

overview

10

Static

static

1

Orderconfi...82.exe

windows7-x64

10

Orderconfi...82.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Orderconfirmation#27682.exe

  • Size

    365KB

  • Sample

    230324-gj57msef4w

  • MD5

    0d9e38ba72b9994260768357559328a3

  • SHA1

    180ee5d2b2d8c6f5e993f77a1d9e1df9bd437bbd

  • SHA256

    24c78f9f8f15c94f2616a13adce3fda09255d3e1a4b762ef21b561318c082d65

  • SHA512

    9aec08e46fd7676794bcb4a39d216157569cf47d585eb53fcd4ce7dbb35deac158b6e64af2708345626f014b6cb36a8045438afedc75a2d60d6c59cee4989507

  • SSDEEP

    6144:2JAk9dNbuyG+VkT2Elng0ydlBDK9rPn9mYwYqYYw9/KSKTBdyjgpCrVaIYPX:Z49NsT2Eln1yZ29rP9mrdywm

Score
10/10
redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

adm1234.duckdns.org:20603

Targets

    • Target

      Orderconfirmation#27682.exe

    • Size

      365KB

    • MD5

      0d9e38ba72b9994260768357559328a3

    • SHA1

      180ee5d2b2d8c6f5e993f77a1d9e1df9bd437bbd

    • SHA256

      24c78f9f8f15c94f2616a13adce3fda09255d3e1a4b762ef21b561318c082d65

    • SHA512

      9aec08e46fd7676794bcb4a39d216157569cf47d585eb53fcd4ce7dbb35deac158b6e64af2708345626f014b6cb36a8045438afedc75a2d60d6c59cee4989507

    • SSDEEP

      6144:2JAk9dNbuyG+VkT2Elng0ydlBDK9rPn9mYwYqYYw9/KSKTBdyjgpCrVaIYPX:Z49NsT2Eln1yZ29rP9mrdywm

    Score
    10/10
    redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks