General

  • Target

    rexe.exe

  • Size

    95KB

  • Sample

    230701-j32pnsgb84

  • MD5

    e2926de61afde26d62470f5638fb5ca8

  • SHA1

    5ddfc9b8e68250d0685d79753e4ec1aa3a4caa98

  • SHA256

    f9247ad46bc3956636fb05ed396ca28a5a71b710aa84ca6cb397294bfa7f4c00

  • SHA512

    1f8a6ac15ebfad1c3fe19ea8103ca69c5c2817a7e835e25e2d87090d699aa38b71f11f49d4ec4662b1eb11fb0156cebf4ea2eab36dcf21f3b36a9ce9216e2232

  • SSDEEP

    1536:1qswlqWWlbG6jejoigI/43Ywzi0Zb78ivombfexv0ujXyyed253teulgS6pg:zgReY/+zi0ZbYe1g0ujyzdBg

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

r.tocat.co:1337

Targets

    • Target

      rexe.exe

    • Size

      95KB

    • MD5

      e2926de61afde26d62470f5638fb5ca8

    • SHA1

      5ddfc9b8e68250d0685d79753e4ec1aa3a4caa98

    • SHA256

      f9247ad46bc3956636fb05ed396ca28a5a71b710aa84ca6cb397294bfa7f4c00

    • SHA512

      1f8a6ac15ebfad1c3fe19ea8103ca69c5c2817a7e835e25e2d87090d699aa38b71f11f49d4ec4662b1eb11fb0156cebf4ea2eab36dcf21f3b36a9ce9216e2232

    • SSDEEP

      1536:1qswlqWWlbG6jejoigI/43Ywzi0Zb78ivombfexv0ujXyyed253teulgS6pg:zgReY/+zi0ZbYe1g0ujyzdBg

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Matrix

Tasks