Overview

overview

10

Static

static

3

79c2644b69...e4.exe

windows7-x64

10

79c2644b69...e4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    79c2644b6900df6336a9feddde98eae4

  • Size

    798KB

  • Sample

    240127-keltzsacak

  • MD5

    79c2644b6900df6336a9feddde98eae4

  • SHA1

    3717e912455e85d0262356aebccc937f0a4790d2

  • SHA256

    bed4c9f14696cc59c90575c491b4b60208c9cb602da5b29a63cdabbf448135fe

  • SHA512

    9e3f644519c36d7001c6a89f6f5191d4b8d2de5371f9336671eb5639313fb711e66dca89fd72bea94962c69ce30085833006ee3e21d47a787ab8f03eaf885d11

  • SSDEEP

    12288:Yakftd38PlWKAi7oqXncg4+prNEnlmxkgcCMV29hJl5i8oirqGONZORMCjPeOAOK:zkftNiroqn4kNEZVHShPY8oWONWtAT

Score
10/10
redlinesectoprat@big_tastyyy@tybaby_lztinfostealerrattrojan

Malware Config

Extracted

Family

redline

C2

190.2.145.47:80

Extracted

Family

redline

Botnet

@big_tastyyy

C2

87.251.71.44:80

Extracted

Family

redline

Botnet

@TyBaby_LZT

C2

135.181.171.9:16077

Targets

    • Target

      79c2644b6900df6336a9feddde98eae4

    • Size

      798KB

    • MD5

      79c2644b6900df6336a9feddde98eae4

    • SHA1

      3717e912455e85d0262356aebccc937f0a4790d2

    • SHA256

      bed4c9f14696cc59c90575c491b4b60208c9cb602da5b29a63cdabbf448135fe

    • SHA512

      9e3f644519c36d7001c6a89f6f5191d4b8d2de5371f9336671eb5639313fb711e66dca89fd72bea94962c69ce30085833006ee3e21d47a787ab8f03eaf885d11

    • SSDEEP

      12288:Yakftd38PlWKAi7oqXncg4+prNEnlmxkgcCMV29hJl5i8oirqGONZORMCjPeOAOK:zkftNiroqn4kNEZVHShPY8oWONWtAT

    Score
    10/10
    redlinesectoprat@big_tastyyy@tybaby_lztinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks