Overview

overview

10

Static

static

3

dcf84c217b...97.exe

windows7-x64

10

dcf84c217b...97.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dcf84c217bf5be49d9db99bb5a295897

  • Size

    587KB

  • Sample

    240325-cg2dfsda94

  • MD5

    dcf84c217bf5be49d9db99bb5a295897

  • SHA1

    0cda4df173173098271056cce845a62e7e4a5483

  • SHA256

    47f301e20b3b3bcbaab349739caa6a836f63ca954ec3410aaf3ab5f67e13a5fa

  • SHA512

    0e6642ea4a8adb73c3bf7321a1b426821744852dcf52b22cf6a91e49c10b640eaf4c9640f38508ddea12037cd3e9f259b9eb37f98462e18950fb4e30a9439ee0

  • SSDEEP

    12288:Wkbc/LqCmcINhsR1GdEsEwSgMHF4+b2xR07woNTfHFT:lIOncIO1CK

Score
10/10
redlinesectopratdibildinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

dibild

C2

135.148.139.222:33569

Targets

    • Target

      dcf84c217bf5be49d9db99bb5a295897

    • Size

      587KB

    • MD5

      dcf84c217bf5be49d9db99bb5a295897

    • SHA1

      0cda4df173173098271056cce845a62e7e4a5483

    • SHA256

      47f301e20b3b3bcbaab349739caa6a836f63ca954ec3410aaf3ab5f67e13a5fa

    • SHA512

      0e6642ea4a8adb73c3bf7321a1b426821744852dcf52b22cf6a91e49c10b640eaf4c9640f38508ddea12037cd3e9f259b9eb37f98462e18950fb4e30a9439ee0

    • SSDEEP

      12288:Wkbc/LqCmcINhsR1GdEsEwSgMHF4+b2xR07woNTfHFT:lIOncIO1CK

    Score
    10/10
    redlinesectopratdibildinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks