Overview

overview

10

Static

static

3

c32de2d78b...96.exe

windows7-x64

10

c32de2d78b...96.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c32de2d78bb739833ebcb957a1cfd896

  • Size

    1014KB

  • Sample

    240312-my922aha99

  • MD5

    c32de2d78bb739833ebcb957a1cfd896

  • SHA1

    371dd5c7ed339851c1db8797156f662746c40d39

  • SHA256

    683148acb2f2071d1110c50b5ba5848ac5d1ad29e506fcae3086751128d105be

  • SHA512

    f7441316a634a2e3d0cf76d6b4e168eb1b3b2d4c369ba2076f3dbbe030ea21ff27f40a3f79ba183b340b042de195953087cebb1c0c3164c5260e0cd8f1598826

  • SSDEEP

    24576:EJMduewP/dXZRFXD4kcSNgwwLwfHXbA2KUp30:Eadudb0sNJwL402Fp

Score
10/10
redlinesectopratusainfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

USA

C2

185.215.113.62:51929

Targets

    • Target

      c32de2d78bb739833ebcb957a1cfd896

    • Size

      1014KB

    • MD5

      c32de2d78bb739833ebcb957a1cfd896

    • SHA1

      371dd5c7ed339851c1db8797156f662746c40d39

    • SHA256

      683148acb2f2071d1110c50b5ba5848ac5d1ad29e506fcae3086751128d105be

    • SHA512

      f7441316a634a2e3d0cf76d6b4e168eb1b3b2d4c369ba2076f3dbbe030ea21ff27f40a3f79ba183b340b042de195953087cebb1c0c3164c5260e0cd8f1598826

    • SSDEEP

      24576:EJMduewP/dXZRFXD4kcSNgwwLwfHXbA2KUp30:Eadudb0sNJwL402Fp

    Score
    10/10
    redlinesectopratusainfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks