General

  • Target

    1fb1ef30ec0879d89263bab2c30fff9f

  • Size

    313KB

  • Sample

    231230-283g9sbbfk

  • MD5

    1fb1ef30ec0879d89263bab2c30fff9f

  • SHA1

    468af3200e9caf009280ded7092fde94a6824b3a

  • SHA256

    cc1b3e18520c1f5ae7040cbfd2d74c9d3e5c3c47aa01d44d1037fffcbff96564

  • SHA512

    9820dfee0061e6fe65ff777443d975e95a1abb38f3c6c701a44f87f24c91b2d2f6981095a63cf3ab22102534348d806c0be411d8bb7b2cb95b62b1a07514b943

  • SSDEEP

    6144:PjL8hzvPbLk3xWWBhpTmdjGgS4w6DXFXe1+VXfVRSP7EsI5/:Pjwlv6PBhpCC6DBv1Hc9c

Malware Config

Extracted

Family

redline

Botnet

NEWSWERVER-777

C2

185.215.113.80:15548

Targets

    • Target

      1fb1ef30ec0879d89263bab2c30fff9f

    • Size

      313KB

    • MD5

      1fb1ef30ec0879d89263bab2c30fff9f

    • SHA1

      468af3200e9caf009280ded7092fde94a6824b3a

    • SHA256

      cc1b3e18520c1f5ae7040cbfd2d74c9d3e5c3c47aa01d44d1037fffcbff96564

    • SHA512

      9820dfee0061e6fe65ff777443d975e95a1abb38f3c6c701a44f87f24c91b2d2f6981095a63cf3ab22102534348d806c0be411d8bb7b2cb95b62b1a07514b943

    • SSDEEP

      6144:PjL8hzvPbLk3xWWBhpTmdjGgS4w6DXFXe1+VXfVRSP7EsI5/:Pjwlv6PBhpCC6DBv1Hc9c

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Matrix

Tasks