General
-
Target
0f31ab1080da324db83f6e486495656167b2b257581c06759958a04a6b0e583d
-
Size
499KB
-
Sample
240707-hcftvawcpr
-
MD5
dd18e071d32612795c5f549f1841ddfa
-
SHA1
92db89ec4396b66b85cbd7ee612cbdc9a378348e
-
SHA256
0f31ab1080da324db83f6e486495656167b2b257581c06759958a04a6b0e583d
-
SHA512
042cec088b451f6948f8dc1e622432ec15a5a86bbfd186c699bbda60057d0d97aefd4a6c6a070434a44d3cbcda062eed6235b67258b25a4181f0e9e8eda5ed14
-
SSDEEP
12288:jzUyDBILfREAyfX9DRVaU35pSSLWc/uR7/Jr8idyhAke3e:XJBILfGACNDJ5M8d/uZ/iBWJO
Malware Config
Extracted
redline
cheat
161.129.65.145:4483
Targets
-
-
Target
557b3fa206360feb6819be479141409870903732a43861f8e882e3fa5c3f96a5.exe
-
Size
534KB
-
MD5
c3fdf39d2d65a017f26078457440e032
-
SHA1
fc0aa0a24f6aaf76a95ae7c42d248db182da70ae
-
SHA256
557b3fa206360feb6819be479141409870903732a43861f8e882e3fa5c3f96a5
-
SHA512
3d6930cb8267ebeb77d6cc44b593d091a649fa0abd3fb694746c7c19b42c80140730a84a8eadefa15df7586c9464a20fda582b37c1f41f237affe8804077e5c8
-
SSDEEP
12288:z5mZN9d8Nf+wYA9BLhV9uWLiPgdfkxIexYHEaE+og:c96VH1VOPEkuEarf
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-