Overview

overview

10

Static

static

10

HMC.exe

windows7-x64

10

HMC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HMC.exe

  • Size

    3.0MB

  • Sample

    240527-nyxx5sac6w

  • MD5

    6e4727684bbce2a7e6ce6824792c5cd8

  • SHA1

    d20e40c0e81476dbecdbe859931a25d279fc055e

  • SHA256

    3c0d3ca35dcf977eade9897106a46ae8def8d1eecd757cc07e31bd13b00d2198

  • SHA512

    5c55bda7008c5c54c8122e7934c3ef0f70325138a4fbff4201d430fccac13d4ade2b9be8aa86e1b8969bc26f84303d2ccb1a20cd1980ba7a85013d37a0024200

  • SSDEEP

    24576:fVsQ6BKfC+CWDU2fy6Uuri8MmOmbCYUz7PH8Zeaj0HM3ow5Xty:fVeBB2kMOnYUvPb

Score
10/10
redlinesectopratcheckerinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

CHECKER

C2

41.216.183.150:32356

Targets

    • Target

      HMC.exe

    • Size

      3.0MB

    • MD5

      6e4727684bbce2a7e6ce6824792c5cd8

    • SHA1

      d20e40c0e81476dbecdbe859931a25d279fc055e

    • SHA256

      3c0d3ca35dcf977eade9897106a46ae8def8d1eecd757cc07e31bd13b00d2198

    • SHA512

      5c55bda7008c5c54c8122e7934c3ef0f70325138a4fbff4201d430fccac13d4ade2b9be8aa86e1b8969bc26f84303d2ccb1a20cd1980ba7a85013d37a0024200

    • SSDEEP

      24576:fVsQ6BKfC+CWDU2fy6Uuri8MmOmbCYUz7PH8Zeaj0HM3ow5Xty:fVeBB2kMOnYUvPb

    Score
    10/10
    redlinesectopratcheckerinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks