Overview

overview

10

Static

static

1

3d5f4a6a06...e2.exe

windows7-x64

10

3d5f4a6a06...e2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d5f4a6a061550225a30e76f8ff8ef379f158d14862c4b76a56a0844114de8e2.zip

  • Size

    7.2MB

  • Sample

    230329-r61wjsad2s

  • MD5

    4ea9c69a064252d4938f1a13fa2f47f5

  • SHA1

    e6d38869c2fbf53ea8dc5e16d0493d652ea0ac25

  • SHA256

    d66aa5d9471168e262c16636a54de48022b6f75b622f8d1faf74c31087ef9964

  • SHA512

    162e02cca59e3c273140cc09ae39c8507d6aeecee6d508b48bec757ce3b3bf295d81b5c92ccc5b59bbadf2108aa3537c7fdf22a772f5964fbf6e094b2a8d8188

  • SSDEEP

    196608:hHdF2nfEUmkUl9pl9geWBXkQvqQ4xGn07xa:NdqfEDpXr938ZvhnQa

Score
10/10
redlinesectopratcheatinfostealerpyinstallerrattrojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

45.141.215.79:1639

Targets

    • Target

      3d5f4a6a061550225a30e76f8ff8ef379f158d14862c4b76a56a0844114de8e2

    • Size

      7.2MB

    • MD5

      7212e623e04d3427364e7f00a95bf932

    • SHA1

      5f8e0384cf7c209d804d9b10e3d2281a9c391fe7

    • SHA256

      3d5f4a6a061550225a30e76f8ff8ef379f158d14862c4b76a56a0844114de8e2

    • SHA512

      3a2ac1111eaaf17475235ee233819286848c45bb2d69a42803fde15f4ae609f63120ca3a9f945b80af1a7c565941e81513ecb90ef9ea1320240c81f77091f7df

    • SSDEEP

      196608:r+QDCeRpnhgR/BQ+/Svwj47kuTkGfxDlDlAs:s6MQ+/SvwOvY4

    Score
    10/10
    redlinesectopratcheatinfostealerpyinstallerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Account Manipulation

1
T1098

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks