General

  • Target

    87f71a9a6f8d4f370281a4e7f43100f0N

  • Size

    117KB

  • Sample

    240827-qykc6atble

  • MD5

    87f71a9a6f8d4f370281a4e7f43100f0

  • SHA1

    41aa65bd1575934057b35f6994a6c390ed670a85

  • SHA256

    245a4d1a2819eae25331620b629fa12c316190de7bd556078960aaade1e1f3f0

  • SHA512

    508c8b888514fd15d1dd1e057a903d4d6ea9a6763498189ec8279f3944f06bdcf741d84c86bc98dfe62759f1b2fbcca70a690198dedb5295a1b08cc917bc174a

  • SSDEEP

    1536:H4e1Ypb1neFUXeMKVFrPwZqaqjbuRGdQnwHuyq/dUV3dbknErG6qTaoigrtl1SIf:Jo+dFLwZWvQn9yOdUPkEubtlkIf

Malware Config

Extracted

Family

redline

Botnet

@koshachuy

C2

185.230.143.48:14462

Targets

    • Target

      87f71a9a6f8d4f370281a4e7f43100f0N

    • Size

      117KB

    • MD5

      87f71a9a6f8d4f370281a4e7f43100f0

    • SHA1

      41aa65bd1575934057b35f6994a6c390ed670a85

    • SHA256

      245a4d1a2819eae25331620b629fa12c316190de7bd556078960aaade1e1f3f0

    • SHA512

      508c8b888514fd15d1dd1e057a903d4d6ea9a6763498189ec8279f3944f06bdcf741d84c86bc98dfe62759f1b2fbcca70a690198dedb5295a1b08cc917bc174a

    • SSDEEP

      1536:H4e1Ypb1neFUXeMKVFrPwZqaqjbuRGdQnwHuyq/dUV3dbknErG6qTaoigrtl1SIf:Jo+dFLwZWvQn9yOdUPkEubtlkIf

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks