Overview

overview

10

Static

static

1

342d3e7071...80.exe

windows7-x64

10

342d3e7071...80.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    342d3e7071f207470417fa3fe3ff9280.exe

  • Size

    803KB

  • Sample

    240706-dadt9awdrg

  • MD5

    342d3e7071f207470417fa3fe3ff9280

  • SHA1

    5422472887421624d087ae9d768b1441352a7d03

  • SHA256

    f2d3c92e1f5ab8109ec4f960165a1d8d5f5cee846b51b44d77ab4a1ddcba10d7

  • SHA512

    a07953bf15ceb922bf0ed3cae84da19db47ba67252a4e7af682a493f659bd2574a6e0c4548b12527a61a401c872221db25d5fe05aa547455c9dcea46f02b9d81

  • SSDEEP

    24576:0/4RPLub9awtRZykfWJ/+IyDHvipQPAOKrf7:09tXVfWcIybiF7r7

Score
10/10
redlinesectopratcheatdiscoveryexecutioninfostealerratspywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

45.137.22.124:55615

Targets

    • Target

      342d3e7071f207470417fa3fe3ff9280.exe

    • Size

      803KB

    • MD5

      342d3e7071f207470417fa3fe3ff9280

    • SHA1

      5422472887421624d087ae9d768b1441352a7d03

    • SHA256

      f2d3c92e1f5ab8109ec4f960165a1d8d5f5cee846b51b44d77ab4a1ddcba10d7

    • SHA512

      a07953bf15ceb922bf0ed3cae84da19db47ba67252a4e7af682a493f659bd2574a6e0c4548b12527a61a401c872221db25d5fe05aa547455c9dcea46f02b9d81

    • SSDEEP

      24576:0/4RPLub9awtRZykfWJ/+IyDHvipQPAOKrf7:09tXVfWcIybiF7r7

    Score
    10/10
    redlinesectopratcheatdiscoveryexecutioninfostealerratspywarestealertrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks