Overview

overview

10

Static

static

3

06b526f37e...53.exe

windows7-x64

10

06b526f37e...53.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06b526f37e61c68f5034ebb8eb5b8e53.exe

  • Size

    820KB

  • Sample

    240302-c84mwshb4y

  • MD5

    06b526f37e61c68f5034ebb8eb5b8e53

  • SHA1

    5145bf00872e3360d94d5d0a202f6b8caff15f1b

  • SHA256

    34fbf4f0c282b6c22b916ada0351fbb6d9208bbf8501843092639ae26abac482

  • SHA512

    d687a354c65ca53389f17f7575b7e3437a816b658666bccf31449a88556b12c1cd60f610116097419f572262681b8ac278fb9eeaae5aa08f83eaa286a1717deb

  • SSDEEP

    24576:bxLsMs8WdZ78DQEisZ4b8FQ1gCmk1YEOp+btzYPNIlxDRRR:JsldmDQD8wYEpZl7b

Score
10/10
redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

45.137.22.243:55615

Targets

    • Target

      06b526f37e61c68f5034ebb8eb5b8e53.exe

    • Size

      820KB

    • MD5

      06b526f37e61c68f5034ebb8eb5b8e53

    • SHA1

      5145bf00872e3360d94d5d0a202f6b8caff15f1b

    • SHA256

      34fbf4f0c282b6c22b916ada0351fbb6d9208bbf8501843092639ae26abac482

    • SHA512

      d687a354c65ca53389f17f7575b7e3437a816b658666bccf31449a88556b12c1cd60f610116097419f572262681b8ac278fb9eeaae5aa08f83eaa286a1717deb

    • SSDEEP

      24576:bxLsMs8WdZ78DQEisZ4b8FQ1gCmk1YEOp+btzYPNIlxDRRR:JsldmDQD8wYEpZl7b

    Score
    10/10
    redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks