Overview

overview

10

Static

static

3

PO.scr.exe

windows7-x64

10

PO.scr.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO.scr.exe

  • Size

    518KB

  • Sample

    240625-pp2emssgqr

  • MD5

    a11877acbf615954a0b143f09aa1057f

  • SHA1

    8f44c43d8fb4883db145a0908ac741c86dd06976

  • SHA256

    7571ed6e3695bda8a03c039b44eca04081151362ab31340fcfb31523bf0084bb

  • SHA512

    40b1a077b60ebddf48df1c01abc0c4be65dc09a5dca81a73adecd4a21a98539d0298cdc34892c6ed78e3a2e51dcebb843e0c7c037fdd407414b099cae8dc254e

  • SSDEEP

    12288:QENwtNQ7FJant11waVxFxWYkKOYHfaTxGCdpAgH:fj7mt1KaLFxGHYHi0CdpA

Score
10/10
redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

213.227.129.32:4483

Targets

    • Target

      PO.scr.exe

    • Size

      518KB

    • MD5

      a11877acbf615954a0b143f09aa1057f

    • SHA1

      8f44c43d8fb4883db145a0908ac741c86dd06976

    • SHA256

      7571ed6e3695bda8a03c039b44eca04081151362ab31340fcfb31523bf0084bb

    • SHA512

      40b1a077b60ebddf48df1c01abc0c4be65dc09a5dca81a73adecd4a21a98539d0298cdc34892c6ed78e3a2e51dcebb843e0c7c037fdd407414b099cae8dc254e

    • SSDEEP

      12288:QENwtNQ7FJant11waVxFxWYkKOYHfaTxGCdpAgH:fj7mt1KaLFxGHYHi0CdpA

    Score
    10/10
    redlinesectopratcheatdiscoveryinfostealerratspywarestealertrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks