Overview

overview

10

Static

static

1

42c5a6e855...cs.exe

windows7-x64

10

42c5a6e855...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    42c5a6e8550e553a9eaf110450787eb6477fbf19f91021633de56f09ac3aa7c2_NeikiAnalytics.exe

  • Size

    593KB

  • Sample

    240627-dmzbqascmk

  • MD5

    594ed0336dcd69fa78d42e087b4d4330

  • SHA1

    9de053ef9811693a413955086a7f6a4f0a5691fe

  • SHA256

    42c5a6e8550e553a9eaf110450787eb6477fbf19f91021633de56f09ac3aa7c2

  • SHA512

    f8dd18c01416379d477c44ef7ea14cece973dcefdb7e3c9354cbb2a52c48d686b6f280522c6b9261c8dc2cc8fb45c02db871b9679f3b4b4cc41ca9435a03338a

  • SSDEEP

    6144:7Ui5MGU9SzN1BwTGkWs7VWxCs5BVe63d9WTVe2iTUctj9L2E7ncirQ77TaheflPJ:wi5MGU9SBj4YQwBVeMwW9ZL2Mip/cs

Score
10/10
redlinesectopratluxmixinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

LuxMix

C2

185.173.39.94:43378

Targets

    • Target

      42c5a6e8550e553a9eaf110450787eb6477fbf19f91021633de56f09ac3aa7c2_NeikiAnalytics.exe

    • Size

      593KB

    • MD5

      594ed0336dcd69fa78d42e087b4d4330

    • SHA1

      9de053ef9811693a413955086a7f6a4f0a5691fe

    • SHA256

      42c5a6e8550e553a9eaf110450787eb6477fbf19f91021633de56f09ac3aa7c2

    • SHA512

      f8dd18c01416379d477c44ef7ea14cece973dcefdb7e3c9354cbb2a52c48d686b6f280522c6b9261c8dc2cc8fb45c02db871b9679f3b4b4cc41ca9435a03338a

    • SSDEEP

      6144:7Ui5MGU9SzN1BwTGkWs7VWxCs5BVe63d9WTVe2iTUctj9L2E7ncirQ77TaheflPJ:wi5MGU9SBj4YQwBVeMwW9ZL2Mip/cs

    Score
    10/10
    redlinesectopratluxmixinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks