Overview

overview

10

Static

static

3

3b9d70c67f...b2.exe

windows7-x64

10

3b9d70c67f...b2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b9d70c67fb380eedcb5d04c6d3cc9b2

  • Size

    2.0MB

  • Sample

    231225-zcsxvaabaj

  • MD5

    3b9d70c67fb380eedcb5d04c6d3cc9b2

  • SHA1

    09766d3548390ee90f2b60492cba403871f1f082

  • SHA256

    c87beae4bc69463608f2ada586a367e23f167062f6b3a25fb277a2a274dd72e1

  • SHA512

    e1a28074a42639b4cdb70915a7bc36e37fa69dd4ce367842a1c7b65447d005dfc020ef0041df6401628e2210a62759b4baf43243697b03c60a219b52b804652a

  • SSDEEP

    24576:qja+0QKT262+kJwdU+hJay4RBkzLVumLg5L1GlQNQ6qJ8nwWgCRI4MVATVbZ9ofC:qjaWm2Z+k6S+IE4mEtFNIffcVECb

Score
10/10
redlinesectopratxxluchxx1infostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

xxluchxx1

C2

185.172.129.61:52372

Targets

    • Target

      3b9d70c67fb380eedcb5d04c6d3cc9b2

    • Size

      2.0MB

    • MD5

      3b9d70c67fb380eedcb5d04c6d3cc9b2

    • SHA1

      09766d3548390ee90f2b60492cba403871f1f082

    • SHA256

      c87beae4bc69463608f2ada586a367e23f167062f6b3a25fb277a2a274dd72e1

    • SHA512

      e1a28074a42639b4cdb70915a7bc36e37fa69dd4ce367842a1c7b65447d005dfc020ef0041df6401628e2210a62759b4baf43243697b03c60a219b52b804652a

    • SSDEEP

      24576:qja+0QKT262+kJwdU+hJay4RBkzLVumLg5L1GlQNQ6qJ8nwWgCRI4MVATVbZ9ofC:qjaWm2Z+k6S+IE4mEtFNIffcVECb

    Score
    10/10
    redlinesectopratxxluchxx1infostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks