General

  • Target

    1140-3-0x0000000002E50000-0x0000000002E6C000-memory.dmp

  • Size

    112KB

  • Sample

    231112-f2nvmsdf25

  • MD5

    0a338897428a450487047deab692cf08

  • SHA1

    6b3181b9c7138747e7f35287d0ea07e9d021505a

  • SHA256

    52a2014a15b276232d3034822b0056e23879c4611e4cf346858b85876ddeb743

  • SHA512

    24bf23149678303457f7ea5a62babccdd16ff41ace95826c271ad1c990c47f451aa498b5fb1d138ad3ba64425740015adabd509337d40751296fc7f5ff8531c4

  • SSDEEP

    1536:PscZcDm7VDCdC37rFWiax+4bwhxOMP8x9lANb/AR2jLodb8ERsy0FdjIxoXEVJ/:PFxwi7LCIk2wdblRsyudjlUVp

Malware Config

Extracted

Family

redline

Botnet

110520211012

C2

tete2792-22120.portmap.host:22120

Targets

    • Target

      1140-3-0x0000000002E50000-0x0000000002E6C000-memory.dmp

    • Size

      112KB

    • MD5

      0a338897428a450487047deab692cf08

    • SHA1

      6b3181b9c7138747e7f35287d0ea07e9d021505a

    • SHA256

      52a2014a15b276232d3034822b0056e23879c4611e4cf346858b85876ddeb743

    • SHA512

      24bf23149678303457f7ea5a62babccdd16ff41ace95826c271ad1c990c47f451aa498b5fb1d138ad3ba64425740015adabd509337d40751296fc7f5ff8531c4

    • SSDEEP

      1536:PscZcDm7VDCdC37rFWiax+4bwhxOMP8x9lANb/AR2jLodb8ERsy0FdjIxoXEVJ/:PFxwi7LCIk2wdblRsyudjlUVp

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Matrix

Tasks