Overview

overview

10

Static

static

10

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ece58cdda5d85a7fe7d7262313b8041e3c988d814b7dd60f0468dbb7109596ba

  • Size

    95KB

  • Sample

    240424-k8hpesgc73

  • MD5

    60e00124f9d54b2d423f02dc81b57127

  • SHA1

    a250651ba1f3eb72bcf0f24a31ff2a66b0a39959

  • SHA256

    ece58cdda5d85a7fe7d7262313b8041e3c988d814b7dd60f0468dbb7109596ba

  • SHA512

    4a5b7529c9fd3325632a13fde5b01cd4bd21258fca2c358d3322127f9c74b86c69250a673d9fe9878a2c828870026661df62a3b95d5235b378bf83ff29a82add

  • SSDEEP

    1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed243tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdaY

Score
10/10
redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

91.92.252.220:1337

Targets

    • Target

      ece58cdda5d85a7fe7d7262313b8041e3c988d814b7dd60f0468dbb7109596ba

    • Size

      95KB

    • MD5

      60e00124f9d54b2d423f02dc81b57127

    • SHA1

      a250651ba1f3eb72bcf0f24a31ff2a66b0a39959

    • SHA256

      ece58cdda5d85a7fe7d7262313b8041e3c988d814b7dd60f0468dbb7109596ba

    • SHA512

      4a5b7529c9fd3325632a13fde5b01cd4bd21258fca2c358d3322127f9c74b86c69250a673d9fe9878a2c828870026661df62a3b95d5235b378bf83ff29a82add

    • SSDEEP

      1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed243tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdaY

    Score
    10/10
    redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks