Overview

overview

10

Static

static

3

800f474542...3f.exe

windows7-x64

10

800f474542...3f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    800f47454230a1f51c30a0f0b028c43f

  • Size

    131KB

  • Sample

    240129-rp4acabfg7

  • MD5

    800f47454230a1f51c30a0f0b028c43f

  • SHA1

    dcbc856d372bf3cf984a1e6b0a45242dca3f5c9b

  • SHA256

    054300b788c1435a8a5c381810c3d8d3f90acdaecfea88ea318f4cfc57f4ca1a

  • SHA512

    97382a4f854dc6b248d5b66454284d754c3dfc374443ff52239e1e1c0544aade148f1c4d27870f2c7908087f0157c382b2768b3e9d30eb3d1dcfcd25abfedfe4

  • SSDEEP

    3072:wLUmapmm6wjaqbwfJZqTSwQO8zcFfL6qTdNBMLmBvqi+7SyjR:Fpmm6wjZMHzwQO8zgBriaBSi+7p

Score
10/10
redlinesectopratbuildinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

build

C2

45.67.231.50:7452

Targets

    • Target

      800f47454230a1f51c30a0f0b028c43f

    • Size

      131KB

    • MD5

      800f47454230a1f51c30a0f0b028c43f

    • SHA1

      dcbc856d372bf3cf984a1e6b0a45242dca3f5c9b

    • SHA256

      054300b788c1435a8a5c381810c3d8d3f90acdaecfea88ea318f4cfc57f4ca1a

    • SHA512

      97382a4f854dc6b248d5b66454284d754c3dfc374443ff52239e1e1c0544aade148f1c4d27870f2c7908087f0157c382b2768b3e9d30eb3d1dcfcd25abfedfe4

    • SSDEEP

      3072:wLUmapmm6wjaqbwfJZqTSwQO8zcFfL6qTdNBMLmBvqi+7SyjR:Fpmm6wjZMHzwQO8zgBriaBSi+7p

    Score
    10/10
    redlinesectopratbuildinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks