redline

General

Target

2936c28076b8434601dba5322b3bef97.bin
Size

323KB
Sample

230408-bm85tadc7s
MD5

2936c28076b8434601dba5322b3bef97
SHA1

4dfc412181278822c5e64b831028b06f0dd62ae5
SHA256

875d856c37fde99e43deb9fefb56e49a59687aa1fbf830b1b126168a29128e31
SHA512

b88a2d50a0dc1a42ebe4ac2b3a44ccfa6648f5bafe2287a553e8801fea9bc66649be28811330ccb502c11d4ef2ca3a1760e7f4f64112a53250cd6fa75adf5ddb
SSDEEP

6144:vYa6juASI1KIq56x+vAKC5Fyqs8itGi4dG4z08Erlf5dCmjpEcxk5rarP:vYJeIq5TvALfyqBiMJdG4zmrlfvbHxIY

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

david1234.duckdns.org:38369

Targets

- Target
  
  2936c28076b8434601dba5322b3bef97.bin
- Size
  
  323KB
- MD5
  
  2936c28076b8434601dba5322b3bef97
- SHA1
  
  4dfc412181278822c5e64b831028b06f0dd62ae5
- SHA256
  
  875d856c37fde99e43deb9fefb56e49a59687aa1fbf830b1b126168a29128e31
- SHA512
  
  b88a2d50a0dc1a42ebe4ac2b3a44ccfa6648f5bafe2287a553e8801fea9bc66649be28811330ccb502c11d4ef2ca3a1760e7f4f64112a53250cd6fa75adf5ddb
- SSDEEP
  
  6144:vYa6juASI1KIq56x+vAKC5Fyqs8itGi4dG4z08Erlf5dCmjpEcxk5rarP:vYJeIq5TvALfyqBiMJdG4zmrlfvbHxIY
Score

10^/10

redline sectoprat cheat discovery infostealer rat spyware stealer trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

SectopRAT

SectopRAT payload

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2