Multiple Malware Dropped Through MSI Package

Aug. 14, 2024, 11:44 a.m.

Description

An analysis reveals the distribution of malware through an MSI package, specifically SectopRat and Redline stealer. The malware employs techniques like executing malicious scripts, disabling security measures, and establishing persistence through scheduled tasks. It communicates with command-and-control servers located in Russia. The investigation underscores the importance of exercising caution when dealing with untrusted software packages.

Date

  • Created: Aug. 14, 2024, 11:14 a.m.
  • Published: Aug. 14, 2024, 11:14 a.m.
  • Modified: Aug. 14, 2024, 11:44 a.m.

Indicators

  • 7808f3aea222cdbec2e53b126f46195f4523e9501882b94e0cd42e30f8484f32
  • 69cad2bf6d63dfc93b632cfd91b5182f14b5140da22f9a0ce82c8b459ad76c38
  • 38c233b38ef1838666ce7204f41349d0ba9431ea4b23fdb05f915cc7a09ff7be
  • 193.3.19.108
  • 83.97.73.190
  • 213.109.202.229
  • http://83.97.73.190:4819
  • http://193.3.19.108/bart.jpg
  • http://213.109.202.229:9000/wbinjget?q=6DDE74FFD397B5FB346F9CA050F6095C
  • http://193.3.19.108/Meta.jpg.
  • filemanaager.net

Attack Patterns

  • SectopRAT
  • Redline
  • T1569.002
  • T1053.005
  • T1037
  • T1064
  • T1059.005
  • T1059.003
  • T1059.001
  • T1059.007
  • T1219
  • T1036
  • T1027
  • T1112

Additional Informations

  • Russian Federation