redline

General

Target
0495e8b62b29df91397da57916e6c0c4
Size 193KB
Sample231224-tegppsgben
SHA256 b0e3286621a4242338db48d850afb9832f5083ed2cb2924359b71a03781f5cf4
MD5 0495e8b62b29df91397da57916e6c0c4
SHA1 c00df56072038eabe4f960e68c245683d370a5d3
SHA512 2d52618059fcabaec712280e4f40d66f34f674cac1f915c4614c6b9c3f36cecd8445639c4d6cfe5707b245a9a0682c8d35b541c650ce033eefef872a3758f628
SSDEEP 6144:K82HQR+1885ebOkE8sEIwEcl/LluJNHoy:n2O+0qkEYVj/LlAI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

696373073

C2

188.40.193.166:43180

Targets

- Target
  0495e8b62b29df91397da57916e6c0c4
- Size 193KB
- SHA256 b0e3286621a4242338db48d850afb9832f5083ed2cb2924359b71a03781f5cf4
- MD5 0495e8b62b29df91397da57916e6c0c4
- SHA1 c00df56072038eabe4f960e68c245683d370a5d3
- SHA512 2d52618059fcabaec712280e4f40d66f34f674cac1f915c4614c6b9c3f36cecd8445639c4d6cfe5707b245a9a0682c8d35b541c650ce033eefef872a3758f628
- SSDEEP 6144:K82HQR+1885ebOkE8sEIwEcl/LluJNHoy:n2O+0qkEYVj/LlAI
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline sectoprat 696373073 infostealer rat trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

SectopRAT

SectopRAT payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2