General

  • Target

    1072d4107b4d5944adf6b3ab7050c80d

  • Size

    296KB

  • Sample

    231219-m8ptvahgfj

  • MD5

    1072d4107b4d5944adf6b3ab7050c80d

  • SHA1

    0c46af5e7a2e0de5d64ec589f6a330a552c0cf05

  • SHA256

    68803da8f625416e62234da836810e0e6e8e19e62c06ab84f3ab3fb1c120433e

  • SHA512

    a5aa9349e3deadcb81bb1ff8fbb5e9b084fcf5884f40076be5fff37a74c15e7c0836759bbe3253f6d6ef264591642123de4e37a4610602969ba2b4eb5f4b30d5

  • SSDEEP

    6144:itCEsD80aKV2OrZiRcbnUvQIgwAZU3vniRp8svk0vy:ECEsD8bUJrZiR+qQI4Ui+svv

Malware Config

Extracted

Family

redline

Botnet

@ggshopdotcom

C2

95.181.152.5:46927

Attributes
  • auth_value

    cdf3919a262c0d6ba99116b375d7551c

Targets

    • Target

      1072d4107b4d5944adf6b3ab7050c80d

    • Size

      296KB

    • MD5

      1072d4107b4d5944adf6b3ab7050c80d

    • SHA1

      0c46af5e7a2e0de5d64ec589f6a330a552c0cf05

    • SHA256

      68803da8f625416e62234da836810e0e6e8e19e62c06ab84f3ab3fb1c120433e

    • SHA512

      a5aa9349e3deadcb81bb1ff8fbb5e9b084fcf5884f40076be5fff37a74c15e7c0836759bbe3253f6d6ef264591642123de4e37a4610602969ba2b4eb5f4b30d5

    • SSDEEP

      6144:itCEsD80aKV2OrZiRcbnUvQIgwAZU3vniRp8svk0vy:ECEsD8bUJrZiR+qQI4Ui+svv

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Matrix

Tasks