Overview

overview

10

Static

static

7

9918daecd7...78.exe

windows7-x64

10

9918daecd7...78.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9918daecd7bf9c87e285d506568ea7ccef81c7670eab4266fb7ca01576989178.exe

  • Size

    3.0MB

  • Sample

    241123-zpb5vsslcm

  • MD5

    adb44b6260f073b1301b7c528ecce1b2

  • SHA1

    90f84e324cfaa70a2f053726e5f366303ba26a98

  • SHA256

    9918daecd7bf9c87e285d506568ea7ccef81c7670eab4266fb7ca01576989178

  • SHA512

    e14c10158bca545e181b16cc5146324dfeeebe2c6431449779000c10f7002e4da91f0f84029e6f5d3534769c7fbc26c3c6dcd152233a692850a84f6f3ad07370

  • SSDEEP

    49152:oONykdwTu98f1sO2xtqkvRId4vP2DRYlpPncdugvXtO9zUqu6ZJtc+wTrjBDkiQL:B/wqGaxZRlWRYlpovvXMzBLZJtc7Trlg

Score
10/10
redlinesectopratdiscoveryevasioninfostealerratthemidatrojan

Malware Config

Targets

    • Target

      9918daecd7bf9c87e285d506568ea7ccef81c7670eab4266fb7ca01576989178.exe

    • Size

      3.0MB

    • MD5

      adb44b6260f073b1301b7c528ecce1b2

    • SHA1

      90f84e324cfaa70a2f053726e5f366303ba26a98

    • SHA256

      9918daecd7bf9c87e285d506568ea7ccef81c7670eab4266fb7ca01576989178

    • SHA512

      e14c10158bca545e181b16cc5146324dfeeebe2c6431449779000c10f7002e4da91f0f84029e6f5d3534769c7fbc26c3c6dcd152233a692850a84f6f3ad07370

    • SSDEEP

      49152:oONykdwTu98f1sO2xtqkvRId4vP2DRYlpPncdugvXtO9zUqu6ZJtc+wTrjBDkiQL:B/wqGaxZRlWRYlpovvXMzBLZJtc7Trlg

    Score
    10/10
    redlinesectopratdiscoveryevasioninfostealerratthemidatrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Redline family

      redline

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Sectoprat family

      sectoprat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks