Overview

overview

10

Static

static

10

37b47855b6...40.exe

windows7-x64

10

37b47855b6...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    37b47855b6e7dac7af7fa051c819199018f8fd06040054bb1c8cdaad64887c40.exe

  • Size

    95KB

  • Sample

    240502-bmzw5seh74

  • MD5

    ac5f78eb678258499cf14f06e7c3c20a

  • SHA1

    ae158c6e81bd36714b27697ca6537284f25964b4

  • SHA256

    37b47855b6e7dac7af7fa051c819199018f8fd06040054bb1c8cdaad64887c40

  • SHA512

    884d8983c815342322efde132b9ae25547c8b87ee00205106e3d2c77d999259dd27036543147103c3ef3332ac293769e62ac72fc7cb1186fd562eda4288776f5

  • SSDEEP

    1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2t33tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzddY

Score
10/10
redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

54.39.249.56:61562

Targets

    • Target

      37b47855b6e7dac7af7fa051c819199018f8fd06040054bb1c8cdaad64887c40.exe

    • Size

      95KB

    • MD5

      ac5f78eb678258499cf14f06e7c3c20a

    • SHA1

      ae158c6e81bd36714b27697ca6537284f25964b4

    • SHA256

      37b47855b6e7dac7af7fa051c819199018f8fd06040054bb1c8cdaad64887c40

    • SHA512

      884d8983c815342322efde132b9ae25547c8b87ee00205106e3d2c77d999259dd27036543147103c3ef3332ac293769e62ac72fc7cb1186fd562eda4288776f5

    • SSDEEP

      1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2t33tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzddY

    Score
    10/10
    redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks