Overview

overview

10

Static

static

3

9912cf587f...48.exe

windows7-x64

10

9912cf587f...48.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9912cf587f9d8f6063661385aa36a848

  • Size

    1.1MB

  • Sample

    231219-zjmpeabdc9

  • MD5

    9912cf587f9d8f6063661385aa36a848

  • SHA1

    df2694a1f0cb34ead48f3f8574c423ded693a7fa

  • SHA256

    910ceaeb607b44cc583482a828050d8696b7c80fd6bfc15f67889f1f37fe7491

  • SHA512

    6c68f87fd4dacd2fa479f4fdf3bafd1af0804e38cf3cc257d8ec153c9e7c280f7ffe4adc0ea6c000514d15e869bade73eb9e6812fddd5eeedd5c3d8c9009c2f9

  • SSDEEP

    24576:ncoKwrldiMNtn2bzPBKWghvHSLx7vWSbJ4ZS0POeyqNMsKqvbW:ncoKovtn2BvghPox7dbJc46NLvb

Score
10/10
redlinesectopratbuildinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

build

C2

92.119.115.229:48282

Targets

    • Target

      9912cf587f9d8f6063661385aa36a848

    • Size

      1.1MB

    • MD5

      9912cf587f9d8f6063661385aa36a848

    • SHA1

      df2694a1f0cb34ead48f3f8574c423ded693a7fa

    • SHA256

      910ceaeb607b44cc583482a828050d8696b7c80fd6bfc15f67889f1f37fe7491

    • SHA512

      6c68f87fd4dacd2fa479f4fdf3bafd1af0804e38cf3cc257d8ec153c9e7c280f7ffe4adc0ea6c000514d15e869bade73eb9e6812fddd5eeedd5c3d8c9009c2f9

    • SSDEEP

      24576:ncoKwrldiMNtn2bzPBKWghvHSLx7vWSbJ4ZS0POeyqNMsKqvbW:ncoKovtn2BvghPox7dbJc46NLvb

    Score
    10/10
    redlinesectopratbuildinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks