redline

General

Target

316352339068b73a707dfb3f7607a20570ebbfcf353c4ba3673f20020265f550.exe
Size

747KB
Sample

240626-bhxk8avfjg
MD5

6e24cd1cd545c6432990490be68b605d
SHA1

f0ea3d92b704140b8a3d1c97c9926fdeadcd0507
SHA256

316352339068b73a707dfb3f7607a20570ebbfcf353c4ba3673f20020265f550
SHA512

daa00fef2d215614af516142f780fa04987f12337ccaae24a8c57260f5733eda23e9df146d66020fd5fedf50f96e999e5045dbd756da96a0cef25448e5de66c5
SSDEEP

12288:r5xWIar6twID63qyyiFGF8PJsoY+YtbP8LHujF/dA+wVwGDH+/fRRCr:1xt46tN63qicUJsoYtbMHSF/u+wSBRRi

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

185.222.58.234:55615

Targets

- Target
  
  316352339068b73a707dfb3f7607a20570ebbfcf353c4ba3673f20020265f550.exe
- Size
  
  747KB
- MD5
  
  6e24cd1cd545c6432990490be68b605d
- SHA1
  
  f0ea3d92b704140b8a3d1c97c9926fdeadcd0507
- SHA256
  
  316352339068b73a707dfb3f7607a20570ebbfcf353c4ba3673f20020265f550
- SHA512
  
  daa00fef2d215614af516142f780fa04987f12337ccaae24a8c57260f5733eda23e9df146d66020fd5fedf50f96e999e5045dbd756da96a0cef25448e5de66c5
- SSDEEP
  
  12288:r5xWIar6twID63qyyiFGF8PJsoY+YtbP8LHujF/dA+wVwGDH+/fRRCr:1xt46tN63qicUJsoYtbMHSF/u+wSBRRi
Score

10^/10

redline sectoprat cheat discovery execution infostealer rat spyware stealer trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects executables packed with SmartAssembly
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

SectopRAT

SectopRAT payload

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects executables packed with SmartAssembly

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2