Overview

overview

10

Static

static

3

winprofile

windows7-x64

3

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97

  • Size

    294KB

  • Sample

    240801-2hdq8athrh

  • MD5

    58ccb4c9da26dbf5584194406ee2f4b3

  • SHA1

    ae91798532b747f410099ef7d0e36bffeca6361c

  • SHA256

    2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97

  • SHA512

    dff6b4bf25fc5b5cf1a64ee645fb0310b072ec69c89a6e863cf9e0800e1d36f8dc4e567cf19c7dc8ac704d351b604cbf8d35959c3a64a10aa6b54f5c8fedb3c2

  • SSDEEP

    6144:M3VPjut1s07wltS102nj9W0t3KMONuGfpul4EdSCM:gZjut1s0qQj9ztaMMdxop3M

Score
10/10
redlinesectopratexodusmarket.iodiscoveryinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

exodusmarket.io

C2

91.92.240.111:1334

Targets

    • Target

      2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97

    • Size

      294KB

    • MD5

      58ccb4c9da26dbf5584194406ee2f4b3

    • SHA1

      ae91798532b747f410099ef7d0e36bffeca6361c

    • SHA256

      2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97

    • SHA512

      dff6b4bf25fc5b5cf1a64ee645fb0310b072ec69c89a6e863cf9e0800e1d36f8dc4e567cf19c7dc8ac704d351b604cbf8d35959c3a64a10aa6b54f5c8fedb3c2

    • SSDEEP

      6144:M3VPjut1s07wltS102nj9W0t3KMONuGfpul4EdSCM:gZjut1s0qQj9ztaMMdxop3M

    Score
    10/10
    discoveryredlinesectopratexodusmarket.ioinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks