Overview

overview

10

Static

static

3

64b6b02782...63.exe

windows7-x64

10

64b6b02782...63.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    64b6b02782f1ef78a4adeb7ab51b2663.exe

  • Size

    371KB

  • Sample

    240106-l5d3haedb2

  • MD5

    64b6b02782f1ef78a4adeb7ab51b2663

  • SHA1

    400e44870b8403e573bbf4d9c5178ddadb54458a

  • SHA256

    c31ca369e71f4c501d3a71deab6c3c5e9c48ff8f3f0b9f806679b96639d8ea5c

  • SHA512

    39dcc56c523515eed6543fd0a74216533215e7118741805197473c7b08e7fe2262e29fe9025779d8d15ba60ae2ed122ca1abc236a66853b6df0dc916ffb3c0bf

  • SSDEEP

    6144:xRM4Ry8uzmqaPqE3E8tSvFjprM3OFb7CaokznAaDfH:xRM4ETzmqaPqE3E8tSvFjprM3OFb7Cal

Score
10/10
redlinesectoprat@oxphoenixinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

@OxPhOenix

C2

3.68.106.170:59223

Targets

    • Target

      64b6b02782f1ef78a4adeb7ab51b2663.exe

    • Size

      371KB

    • MD5

      64b6b02782f1ef78a4adeb7ab51b2663

    • SHA1

      400e44870b8403e573bbf4d9c5178ddadb54458a

    • SHA256

      c31ca369e71f4c501d3a71deab6c3c5e9c48ff8f3f0b9f806679b96639d8ea5c

    • SHA512

      39dcc56c523515eed6543fd0a74216533215e7118741805197473c7b08e7fe2262e29fe9025779d8d15ba60ae2ed122ca1abc236a66853b6df0dc916ffb3c0bf

    • SSDEEP

      6144:xRM4Ry8uzmqaPqE3E8tSvFjprM3OFb7CaokznAaDfH:xRM4ETzmqaPqE3E8tSvFjprM3OFb7Cal

    Score
    10/10
    redlinesectoprat@oxphoenixinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks