Overview

overview

10

Static

static

1

87ca9079e3...fb.exe

windows7-x64

10

87ca9079e3...fb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    87ca9079e307e48fa781b9c39f3e93fb

  • Size

    411KB

  • Sample

    240201-1363tshdgm

  • MD5

    87ca9079e307e48fa781b9c39f3e93fb

  • SHA1

    582c603d178aaa86caa4b6266d859c6e545a3f8f

  • SHA256

    d2f3c8745cdfdc4df1c8b1162dc3f310f358cfb8410eacb5f9b82d82140ace24

  • SHA512

    9cc6ef9b09ff8f9de513bad648c3cb79582f1a3df01d61275ceae5a7df1f4d7adbc475c06bde4e87fc6f046a122c530c5b2ac9c888d0e663b57a59950c8b27c1

  • SSDEEP

    12288:CYVZ4rt++OjGlrN2Vis7mHxowcEKo1WdIcd:X4Zzj2Vz7x+Ko4dIcd

Score
10/10
redlinesectoprat1infostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

1

C2

ynabrdosmc.xyz:80

Targets

    • Target

      87ca9079e307e48fa781b9c39f3e93fb

    • Size

      411KB

    • MD5

      87ca9079e307e48fa781b9c39f3e93fb

    • SHA1

      582c603d178aaa86caa4b6266d859c6e545a3f8f

    • SHA256

      d2f3c8745cdfdc4df1c8b1162dc3f310f358cfb8410eacb5f9b82d82140ace24

    • SHA512

      9cc6ef9b09ff8f9de513bad648c3cb79582f1a3df01d61275ceae5a7df1f4d7adbc475c06bde4e87fc6f046a122c530c5b2ac9c888d0e663b57a59950c8b27c1

    • SSDEEP

      12288:CYVZ4rt++OjGlrN2Vis7mHxowcEKo1WdIcd:X4Zzj2Vz7x+Ko4dIcd

    Score
    10/10
    redlinesectoprat1infostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks