Overview

overview

10

Static

static

1

c08ff513ad...33.exe

windows7-x64

10

c08ff513ad...33.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d6291f04688e967d0b4eb08effefcf3de896b2511684b5f57dd7bdb6a2921404

  • Size

    566KB

  • Sample

    240705-cwd7gasflg

  • MD5

    0d00a43802d22c44e4c15f653c06c8ec

  • SHA1

    411ee21850cd2fcb77c1cc2c9424f2f5a07ead2d

  • SHA256

    d6291f04688e967d0b4eb08effefcf3de896b2511684b5f57dd7bdb6a2921404

  • SHA512

    6cef0d7bfb278eb1d277e70208acf5bd37d0d05b56e7edf09125804417e627affcff3e253e9aca57c55c8d861253ac07c2b99be691fb476749ef27ea89bb7f90

  • SSDEEP

    12288:3sGNmEHvMH9HACguGdZbkOV/mVSsI12S53mOWeMWY:L8EP6gC7GdZJ6I1H2JeMWY

Score
10/10
redlinesectopratcheatexecutioninfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

185.222.58.91:55615

Targets

    • Target

      c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe

    • Size

      713KB

    • MD5

      3599fa63d78413242a88966d3b4b14ef

    • SHA1

      44526b00e847d9a16908c79f72dab1af4a2edf29

    • SHA256

      c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33

    • SHA512

      e04604e58c9a0eb4e6bbea99d59295463cb9058f82c2527502acb6fe47989fc4f72b69338bb66ca5c5fc5a62d785fb65fcd4eb272a6136a1c240592076845d73

    • SSDEEP

      12288:vV9E8GILjWLWg/yvjaRBv5MIorus1IPI4AMqoYg/6vXdW1JeSel43qiukR:7cam5MI+TIPuM//CXd+JWl46i1

    Score
    10/10
    redlinesectopratcheatexecutioninfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks