General

  • Target

    build.exe

  • Size

    95KB

  • Sample

    240519-pmccqshb81

  • MD5

    760bf600ba8eaa08aebfc21f11e84687

  • SHA1

    7eb7eb90e2fe67d408c3c93a1881aa35e3c02438

  • SHA256

    1d954ce7e83b5ca61bbc81818496749803030ba3c352c0aaac2e4e573fd01493

  • SHA512

    4a1d1edea5590260d0c57268399c2dceaf07e6f5ffe82d24ff8095678c4d52513387f851cd8c1335bccf94b4586de7fb54450d7a3ada2bd5c44b3da66830b777

  • SSDEEP

    1536:iqseNqBUlbG6jejoigIk43Ywzi0Zb78ivombfexv0ujXyyed2Y3tmulgS6p4:AOCMYk+zi0ZbYe1g0ujyzdq4

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

memory-intended.gl.at.ply.gg:51752

Targets

    • Target

      build.exe

    • Size

      95KB

    • MD5

      760bf600ba8eaa08aebfc21f11e84687

    • SHA1

      7eb7eb90e2fe67d408c3c93a1881aa35e3c02438

    • SHA256

      1d954ce7e83b5ca61bbc81818496749803030ba3c352c0aaac2e4e573fd01493

    • SHA512

      4a1d1edea5590260d0c57268399c2dceaf07e6f5ffe82d24ff8095678c4d52513387f851cd8c1335bccf94b4586de7fb54450d7a3ada2bd5c44b3da66830b777

    • SSDEEP

      1536:iqseNqBUlbG6jejoigIk43Ywzi0Zb78ivombfexv0ujXyyed2Y3tmulgS6p4:AOCMYk+zi0ZbYe1g0ujyzdq4

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks