Overview

overview

10

Static

static

7

a9231a8961...f7.exe

windows7-x64

10

a9231a8961...f7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a9231a89615f748364c107b5329e78a8bbd3b5f355274f50170a9709bd628ff7.exe

  • Size

    2.3MB

  • Sample

    241124-dxm2fa1ras

  • MD5

    dbc4092546fcf3ac30f1c34fbcebe583

  • SHA1

    d2607f54cc4fdf061f8f75a672e07099c2a84ad6

  • SHA256

    a9231a89615f748364c107b5329e78a8bbd3b5f355274f50170a9709bd628ff7

  • SHA512

    2b0fcaec1dfc6ff354582d12075de0c1a4bdd2b7782fd87f92ccd8cbc25ef23327ba2eb6b148e08e17f4e1483aaec224993e4a1396cdfad96617d1b0222a269d

  • SSDEEP

    49152:NtD46oTUvDEjY+GtjSA05fHAZgsdz4O9lyYB7MkPhjrVKpij:NN4fIvgNwZ01gZgsJ4O399hPhlKp0

Score
10/10
redlinesectopratdiscoveryevasioninfostealerratthemidatrojan

Malware Config

Targets

    • Target

      a9231a89615f748364c107b5329e78a8bbd3b5f355274f50170a9709bd628ff7.exe

    • Size

      2.3MB

    • MD5

      dbc4092546fcf3ac30f1c34fbcebe583

    • SHA1

      d2607f54cc4fdf061f8f75a672e07099c2a84ad6

    • SHA256

      a9231a89615f748364c107b5329e78a8bbd3b5f355274f50170a9709bd628ff7

    • SHA512

      2b0fcaec1dfc6ff354582d12075de0c1a4bdd2b7782fd87f92ccd8cbc25ef23327ba2eb6b148e08e17f4e1483aaec224993e4a1396cdfad96617d1b0222a269d

    • SSDEEP

      49152:NtD46oTUvDEjY+GtjSA05fHAZgsdz4O9lyYB7MkPhjrVKpij:NN4fIvgNwZ01gZgsJ4O399hPhlKp0

    Score
    10/10
    redlinesectopratdiscoveryevasioninfostealerratthemidatrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Redline family

      redline

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Sectoprat family

      sectoprat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks