Overview

overview

10

Static

static

1

Update.bat

windows10-1703-x64

10

Update.bat

windows10-2004-x64

10

Update.bat

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Update.bat

  • Size

    90KB

  • Sample

    240519-te6c3aed4w

  • MD5

    3ad42ff8b873ba057e56908c4a9a2830

  • SHA1

    aa377371f4aa319ac8367809229397e8cbe984f9

  • SHA256

    59eeafa1a036a240d2e5ef549ddd90c5cb484f27dfa94a5f1af91a7e13f380b1

  • SHA512

    e8c96bd11670e299f7ffff4bd1bdb5e56ea65051739fb6ade5269a307742a391af4ad1a9fe19828cb8a5422f317cfc1da31788a7e9478725dbb75b5b4ba867c1

  • SSDEEP

    1536:ZSXLurkFJ+8TTbUGxintEI0l5a82Nx7GokVsIwX8ao8vpCoB9r6b38H1xlWlazf:ZSXLuInDintF0ba82NZbX9ManBCipZ

Score
10/10
redlinesectoprathone_-_installerexecutioninfostealerratspywaretrojan

Malware Config

Extracted

Family

redline

Botnet

Hone_-_Installer

C2

above-collect.gl.at.ply.gg:58881

Targets

    • Target

      Update.bat

    • Size

      90KB

    • MD5

      3ad42ff8b873ba057e56908c4a9a2830

    • SHA1

      aa377371f4aa319ac8367809229397e8cbe984f9

    • SHA256

      59eeafa1a036a240d2e5ef549ddd90c5cb484f27dfa94a5f1af91a7e13f380b1

    • SHA512

      e8c96bd11670e299f7ffff4bd1bdb5e56ea65051739fb6ade5269a307742a391af4ad1a9fe19828cb8a5422f317cfc1da31788a7e9478725dbb75b5b4ba867c1

    • SSDEEP

      1536:ZSXLurkFJ+8TTbUGxintEI0l5a82Nx7GokVsIwX8ao8vpCoB9r6b38H1xlWlazf:ZSXLuInDintF0ba82NZbX9ManBCipZ

    Score
    10/10
    redlinesectoprathone_-_installerexecutioninfostealerratspywaretrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Blocklisted process makes network request

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks