General

  • Target

    564c1daefdce1c31b1c3361621a8f4f8

  • Size

    104KB

  • Sample

    240112-nalj7segcq

  • MD5

    564c1daefdce1c31b1c3361621a8f4f8

  • SHA1

    e688a6ad7f46e02c9dfa7b23589c44a433cc3dea

  • SHA256

    da542e9a955de4b7746da0093ae64de328ad33be2cafe2fefcdedbff6b879da3

  • SHA512

    20392fdd175c5b8a62e60aa5ddd5d5366104c2b44a5c37c84a9fd00ed8c2cd14945e7a2eb65198ee7de0992a4175e7a4a53d850891ae0a59ed425d4d40ccd2c4

  • SSDEEP

    3072:GXqG5F3iozTpa9J9bLlm49ke0ymdKEpKH:Brlm49kPyHm

Malware Config

Extracted

Family

redline

Botnet

@DonukS

C2

81.16.141.203:28365

Targets

    • Target

      564c1daefdce1c31b1c3361621a8f4f8

    • Size

      104KB

    • MD5

      564c1daefdce1c31b1c3361621a8f4f8

    • SHA1

      e688a6ad7f46e02c9dfa7b23589c44a433cc3dea

    • SHA256

      da542e9a955de4b7746da0093ae64de328ad33be2cafe2fefcdedbff6b879da3

    • SHA512

      20392fdd175c5b8a62e60aa5ddd5d5366104c2b44a5c37c84a9fd00ed8c2cd14945e7a2eb65198ee7de0992a4175e7a4a53d850891ae0a59ed425d4d40ccd2c4

    • SSDEEP

      3072:GXqG5F3iozTpa9J9bLlm49ke0ymdKEpKH:Brlm49kPyHm

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Matrix

Tasks