Overview

overview

10

Static

static

3

55c250bdb9...be.exe

windows7-x64

10

55c250bdb9...be.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    55c250bdb998a1c96ae43bfa8a14ed041635109dceda6df6bfc0659f3467b5be

  • Size

    898KB

  • Sample

    231004-s3l4nacg7t

  • MD5

    5996f5969a6b028ae59c6b3d01a8ced5

  • SHA1

    3267286cfa56c7117c09680d1e2a004e7c962fb9

  • SHA256

    55c250bdb998a1c96ae43bfa8a14ed041635109dceda6df6bfc0659f3467b5be

  • SHA512

    0ea3651eb9fddb113e568672f377beb2bb473e05c92cc42e6a0b9246cae69691b509b7779ac5880af8581820d2aafe9c4469dfa47557402d8c9e16ff1849a013

  • SSDEEP

    12288:DyoOjSsEl0w61WArd+8Abfat/Cqdx6sGlEl9b52QOxOsliiazc70y5qdBVgFZM6W:eoOmswfat/Ckx6YdQaz0W0o6Of

Score
10/10
redlinesectopratbildinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

bild

C2

185.215.113.116:41120

Targets

    • Target

      55c250bdb998a1c96ae43bfa8a14ed041635109dceda6df6bfc0659f3467b5be

    • Size

      898KB

    • MD5

      5996f5969a6b028ae59c6b3d01a8ced5

    • SHA1

      3267286cfa56c7117c09680d1e2a004e7c962fb9

    • SHA256

      55c250bdb998a1c96ae43bfa8a14ed041635109dceda6df6bfc0659f3467b5be

    • SHA512

      0ea3651eb9fddb113e568672f377beb2bb473e05c92cc42e6a0b9246cae69691b509b7779ac5880af8581820d2aafe9c4469dfa47557402d8c9e16ff1849a013

    • SSDEEP

      12288:DyoOjSsEl0w61WArd+8Abfat/Cqdx6sGlEl9b52QOxOsliiazc70y5qdBVgFZM6W:eoOmswfat/Ckx6YdQaz0W0o6Of

    Score
    10/10
    redlinesectopratbildinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks