Overview

overview

10

Static

static

1

3599fa63d7...ef.exe

windows7-x64

10

3599fa63d7...ef.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3599fa63d78413242a88966d3b4b14ef.exe

  • Size

    713KB

  • Sample

    240703-tqsaksyhlf

  • MD5

    3599fa63d78413242a88966d3b4b14ef

  • SHA1

    44526b00e847d9a16908c79f72dab1af4a2edf29

  • SHA256

    c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33

  • SHA512

    e04604e58c9a0eb4e6bbea99d59295463cb9058f82c2527502acb6fe47989fc4f72b69338bb66ca5c5fc5a62d785fb65fcd4eb272a6136a1c240592076845d73

  • SSDEEP

    12288:vV9E8GILjWLWg/yvjaRBv5MIorus1IPI4AMqoYg/6vXdW1JeSel43qiukR:7cam5MI+TIPuM//CXd+JWl46i1

Score
10/10
redlinesectopratcheatexecutioninfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

185.222.58.91:55615

Targets

    • Target

      3599fa63d78413242a88966d3b4b14ef.exe

    • Size

      713KB

    • MD5

      3599fa63d78413242a88966d3b4b14ef

    • SHA1

      44526b00e847d9a16908c79f72dab1af4a2edf29

    • SHA256

      c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33

    • SHA512

      e04604e58c9a0eb4e6bbea99d59295463cb9058f82c2527502acb6fe47989fc4f72b69338bb66ca5c5fc5a62d785fb65fcd4eb272a6136a1c240592076845d73

    • SSDEEP

      12288:vV9E8GILjWLWg/yvjaRBv5MIorus1IPI4AMqoYg/6vXdW1JeSel43qiukR:7cam5MI+TIPuM//CXd+JWl46i1

    Score
    10/10
    redlinesectopratcheatexecutioninfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks