redline

General

Target

e7e514f3fb155d14eef5f4fda3f5bc483a82678a810683d931aeaad2c48326fb
Size

1.3MB
Sample

240726-e9ca5szemd
MD5

6ec598a97b7861dea2a420586b1e20ce
SHA1

535dc45cdf26464113276207742cf34e9fd6690d
SHA256

e7e514f3fb155d14eef5f4fda3f5bc483a82678a810683d931aeaad2c48326fb
SHA512

39b27ad7baa93763c689083d40f4582a0d1c7443b4e2eccb303237736ee334b0d8af938bd87e423cf77bfe58232ce053d3e8b264f0290f9d55db2ec823d0ebaf
SSDEEP

24576:U3Tn8To77OBhyF9E1sfygwl/vnpCO4npTnqTb18vMaT/u2wlhAaJxDK2:U3T1CBhgE7gwJnpCO+dneuvl/uFxd

Score

10^/10

Malware Config

Targets

- Target
  
  07f970cff95e1ebcde588ad8808915376341e9f371f9c05a9873f942988b4ac8.exe
- Size
  
  1.8MB
- MD5
  
  d7e66880341b1a0e1bd53696b64e4833
- SHA1
  
  1609e5620c3a8151adc69ba3b058538597d77aa6
- SHA256
  
  07f970cff95e1ebcde588ad8808915376341e9f371f9c05a9873f942988b4ac8
- SHA512
  
  67b34ef9fa7a1ade39b56250dba47853f4a900294dca053ade07f4f59168c520d127ca8809eb2356767444d323424da449493f57946f84ae1d1c9bdb1c20e64f
- SSDEEP
  
  49152:nTvC/MTQYxsWR7aqXHHJpGPn8z+uPQVpSfyYEpq:TjTQYxsWRRnTGP86pA9Ep
Score

10^/10

redline sectoprat aspackv2 credential_access discovery evasion infostealer rat stealer trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- UAC bypass
  evasion trojan
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2