Overview

overview

10

Static

static

10

build.exe

windows10-2004-x64

10

build.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    build.exe

  • Size

    95KB

  • Sample

    240519-pmccqshb81

  • MD5

    760bf600ba8eaa08aebfc21f11e84687

  • SHA1

    7eb7eb90e2fe67d408c3c93a1881aa35e3c02438

  • SHA256

    1d954ce7e83b5ca61bbc81818496749803030ba3c352c0aaac2e4e573fd01493

  • SHA512

    4a1d1edea5590260d0c57268399c2dceaf07e6f5ffe82d24ff8095678c4d52513387f851cd8c1335bccf94b4586de7fb54450d7a3ada2bd5c44b3da66830b777

  • SSDEEP

    1536:iqseNqBUlbG6jejoigIk43Ywzi0Zb78ivombfexv0ujXyyed2Y3tmulgS6p4:AOCMYk+zi0ZbYe1g0ujyzdq4

Score
10/10
redlinesectopratcheatdiscoveryinfostealerratspywaretrojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

memory-intended.gl.at.ply.gg:51752

Targets

    • Target

      build.exe

    • Size

      95KB

    • MD5

      760bf600ba8eaa08aebfc21f11e84687

    • SHA1

      7eb7eb90e2fe67d408c3c93a1881aa35e3c02438

    • SHA256

      1d954ce7e83b5ca61bbc81818496749803030ba3c352c0aaac2e4e573fd01493

    • SHA512

      4a1d1edea5590260d0c57268399c2dceaf07e6f5ffe82d24ff8095678c4d52513387f851cd8c1335bccf94b4586de7fb54450d7a3ada2bd5c44b3da66830b777

    • SSDEEP

      1536:iqseNqBUlbG6jejoigIk43Ywzi0Zb78ivombfexv0ujXyyed2Y3tmulgS6p4:AOCMYk+zi0ZbYe1g0ujyzdq4

    Score
    10/10
    redlinesectopratcheatdiscoveryinfostealerratspywaretrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks