Overview

overview

10

Static

static

3

2e0be6bb19...b1.exe

windows7-x64

10

2e0be6bb19...b1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e0be6bb19bdca4283747a093126dcb1

  • Size

    371KB

  • Sample

    231231-jp24aadhd6

  • MD5

    2e0be6bb19bdca4283747a093126dcb1

  • SHA1

    121ef29abfdc13ee65ccd64ab917fcc7229a1bfb

  • SHA256

    9cd3e6b3b7f4ee9b70b4802e327bd3a61ff65e6047526dd896b3dcac9f5bea68

  • SHA512

    e48fad5e5de9637f8ab7aa4276324a68001a3a430937e72a3505d41b664f97bb800f119f1f51dc99f75fea090efcea3a63ee17ec0dbaa64d00f7f905b5fb9331

  • SSDEEP

    6144:BM4Ry8uzmqaPqE3E8tSvFjprM3OFb7CaokznAaDfH:BM4ETzmqaPqE3E8tSvFjprM3OFb7CaoK

Score
10/10
redlinesectoprat@oxphoenixinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

@OxPhOenix

C2

3.68.106.170:59223

Targets

    • Target

      2e0be6bb19bdca4283747a093126dcb1

    • Size

      371KB

    • MD5

      2e0be6bb19bdca4283747a093126dcb1

    • SHA1

      121ef29abfdc13ee65ccd64ab917fcc7229a1bfb

    • SHA256

      9cd3e6b3b7f4ee9b70b4802e327bd3a61ff65e6047526dd896b3dcac9f5bea68

    • SHA512

      e48fad5e5de9637f8ab7aa4276324a68001a3a430937e72a3505d41b664f97bb800f119f1f51dc99f75fea090efcea3a63ee17ec0dbaa64d00f7f905b5fb9331

    • SSDEEP

      6144:BM4Ry8uzmqaPqE3E8tSvFjprM3OFb7CaokznAaDfH:BM4ETzmqaPqE3E8tSvFjprM3OFb7CaoK

    Score
    10/10
    redlinesectoprat@oxphoenixinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks