Overview

overview

10

Static

static

3

fc4221367e...18.exe

windows7-x64

10

fc4221367e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc4221367edb650623f137dd369995fc_JaffaCakes118

  • Size

    405KB

  • Sample

    240420-jhgtrsbg89

  • MD5

    fc4221367edb650623f137dd369995fc

  • SHA1

    be1a33df3f59e6c7a2ba867e9da91e4e2804c209

  • SHA256

    a84a438502cc9e279a35d3ce7331960b5752428cf8e8e1285c371f1736fb68f3

  • SHA512

    243fa7265191af309a19060e46a697b353bc3894046833c85c05a463cce9df041747c06b444bfba2bd26c169fecb591e5da90209b94a60fb50d5dfbf5513f5b8

  • SSDEEP

    6144:xJN1fnWBCsBcajmIu+WLLU1rkXcI6tPrJqJP+hbFkE21dmGFMXA+7:9BKBNqIu/Sq4rJhsdfMw+7

Score
10/10
redlinesectoprat@f1dmmevasioninfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

@f1dmm

C2

185.80.234.77:17105

Targets

    • Target

      fc4221367edb650623f137dd369995fc_JaffaCakes118

    • Size

      405KB

    • MD5

      fc4221367edb650623f137dd369995fc

    • SHA1

      be1a33df3f59e6c7a2ba867e9da91e4e2804c209

    • SHA256

      a84a438502cc9e279a35d3ce7331960b5752428cf8e8e1285c371f1736fb68f3

    • SHA512

      243fa7265191af309a19060e46a697b353bc3894046833c85c05a463cce9df041747c06b444bfba2bd26c169fecb591e5da90209b94a60fb50d5dfbf5513f5b8

    • SSDEEP

      6144:xJN1fnWBCsBcajmIu+WLLU1rkXcI6tPrJqJP+hbFkE21dmGFMXA+7:9BKBNqIu/Sq4rJhsdfMw+7

    Score
    10/10
    redlinesectoprat@f1dmmevasioninfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks