Overview

overview

10

Static

static

3

055e57a625...ad.exe

windows7-x64

10

055e57a625...ad.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f252f506f84914c3886e791dc984c9e0.bin

  • Size

    170KB

  • Sample

    230524-b8rgwsba7t

  • MD5

    8e21f28659dfea32864bc99ed28c67c3

  • SHA1

    e25336ee7a389c074e111b82c07dc572fe4a1669

  • SHA256

    024c87425d02746dc184e05f84eefa7bc29dca162cb6cfc9c251fa4b15470a9d

  • SHA512

    6688e00a3d1f40a0301317eb57fdd3dbfeee922f860ddf4eaf3fc8c825c99f0c2fff59296a9ea30faca64bf2604dc53679b586807281595e80f46d036477f000

  • SSDEEP

    3072:HOFHW2mHKb9SMzGujAaLmp3+9Rpsf63h0oXC1bVkTs7zzUZ5pqsdmP4uh+:HOLmHKb9SMol2Rlh0owRGcPqwsdmPF+

Score
10/10
redlinesectoprat4infostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

4

C2

147.124.217.33:22650

Targets

    • Target

      055e57a625038b3082161f3e2148a5fafc6f767298cd9ae67f5c1cac9ab71dad.exe

    • Size

      1.8MB

    • MD5

      f252f506f84914c3886e791dc984c9e0

    • SHA1

      62dab96df46604f04cd14ee24f27e32840809722

    • SHA256

      055e57a625038b3082161f3e2148a5fafc6f767298cd9ae67f5c1cac9ab71dad

    • SHA512

      90ae68bfb3ceacd5fa86ed784f3f3ea5f809b703ac35e041adb336eb813bef953421b36b6e7ad77b5c3b2d7a21dd5f975f3c4891a17d7fd1502c60320d73ccb6

    • SSDEEP

      6144:cG5aR292nLhb3ZDcJbmiRBAOb9W4YbPg02ytpRlt:vaR2knLhJWBvWxMFAXlt

    Score
    10/10
    redlinesectoprat4infostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks