General

  • Target

    ce13808dad8149017d9dbc146681a99cd79aaa1288f890c9120a47c347c9db29.exe

  • Size

    95KB

  • Sample

    240806-cwl73swhjk

  • MD5

    bcbcb79606c1833ccef6ca77a7535936

  • SHA1

    0fcbf9cd7ad1963736afac84cc56069654df3d42

  • SHA256

    ce13808dad8149017d9dbc146681a99cd79aaa1288f890c9120a47c347c9db29

  • SHA512

    20a3aa8046c8e3c93a9a55aa3750088da247abb11444883f8463aef0d347520c697067b5a8491de204310660cdb632b828d58898e4f65fd385cb1ec2da752391

  • SSDEEP

    1536:GqsEWnqE7lbG6jejoigIX43Ywzi0Zb78ivombfexv0ujXyyed2XtmulgS6pU:0DnHRYX+zi0ZbYe1g0ujyzdHU

Malware Config

Extracted

Family

redline

Botnet

server.underground-cheat.xyz

C2

server.underground-cheat.xyz:1337

Targets

    • Target

      ce13808dad8149017d9dbc146681a99cd79aaa1288f890c9120a47c347c9db29.exe

    • Size

      95KB

    • MD5

      bcbcb79606c1833ccef6ca77a7535936

    • SHA1

      0fcbf9cd7ad1963736afac84cc56069654df3d42

    • SHA256

      ce13808dad8149017d9dbc146681a99cd79aaa1288f890c9120a47c347c9db29

    • SHA512

      20a3aa8046c8e3c93a9a55aa3750088da247abb11444883f8463aef0d347520c697067b5a8491de204310660cdb632b828d58898e4f65fd385cb1ec2da752391

    • SSDEEP

      1536:GqsEWnqE7lbG6jejoigIX43Ywzi0Zb78ivombfexv0ujXyyed2XtmulgS6pU:0DnHRYX+zi0ZbYe1g0ujyzdHU

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks