Overview

overview

10

Static

static

3

1bb56efc0a...27.exe

windows7-x64

7

1bb56efc0a...27.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad3893ee2a8e40f2700236672635f5aa.bin

  • Size

    9.8MB

  • Sample

    240701-dkgnwsthmb

  • MD5

    4d745a6c5a6a357b51910148b77dc44b

  • SHA1

    bb297fc133130e812db8b708e773a30cb23851ca

  • SHA256

    060e480e35f216a2c99e4eb581407b842c66f4f78c64e3a3cc093f83bfdc5b63

  • SHA512

    f9809740504931f0c4ee44a11e21307ea8c4b91ed008fb0ab22871bcd09ee9d57b95e472178c8bb4d83e95c94aacb958ecb82bc9cfca9522699f83d886f45cc9

  • SSDEEP

    196608:IOah799cnsjNpDFxr6vKcnjRb8sjdTSG/JYlHRelEGm6xkvKB+c1qHWii0F:IOkR2nINHxondmMgRe2/UEKsNHWe

Score
10/10
redlinesectopratcrackedexecutioninfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

cracked

C2

94.156.8.186:37552

Targets

    • Target

      1bb56efc0a5848106b94aed4e2e3e9e05935ad16c50b31b22c1c8f4bf6e3e727.exe

    • Size

      15.6MB

    • MD5

      ad3893ee2a8e40f2700236672635f5aa

    • SHA1

      80f3c0bc398c473e32eeb1420218be6a5feb291d

    • SHA256

      1bb56efc0a5848106b94aed4e2e3e9e05935ad16c50b31b22c1c8f4bf6e3e727

    • SHA512

      748db720695d028c034367f0af26d80ced9700dc497a82ce5a4ce578b39fb24c0f869ddbae3b542b15718523fa3cd29c11f78ded0f9f748ac4954256472a4111

    • SSDEEP

      196608:IZu1YQGj4ZSo3jXkpiliRElNhT7kiibJ488hEipzLmCKg4EFJ9UHytjAIgwX4FVE:+u1OjJEIZulNyHytjma0VvjZ6

    Score
    10/10
    executionredlinesectopratcrackedinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks