redline

General

Target
8225891066bae511731092a28d9f373625b6732eb62e5f6394ff2ad39c89d8d6
Size 216KB
Sample240830-3shzcstdmq
SHA256 8225891066bae511731092a28d9f373625b6732eb62e5f6394ff2ad39c89d8d6
MD5 fb807cc0d17a187537bd326ec12ffd87
SHA1 4594b6f1d6845bdb466ee28e41c221c524c6c296
SHA512 a64b61a50d20ce36579e95710deac1e4ec07c54640e65b2eab25aa2554c39a531cf41babab6ec1d72f10a98ccc1f8d411081130f335726da22fe09160e90b291
SSDEEP 6144:TvU83ZB/rMVJg8R07Ui9Kq4D34fEHROBH:A87CRFMViROBH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

shop

C2

45.9.20.107:46187

Attributes

auth_value
60c75f1e2d31f6bac6dd7edad67d8615

Targets

- Target
  44a8986a9d243e1314b550772eff8cc669597e6b560abacbe3021008e69fb4eb
- Size 366KB
- SHA256 44a8986a9d243e1314b550772eff8cc669597e6b560abacbe3021008e69fb4eb
- MD5 318ee68d0d7604a7db9b524056de0bb2
- SHA1 505adad7388b315f4d61158808c26023bf6a9201
- SHA512 49b8e3b381ae768abe13d53b62b20056f7894eb9854aa42dc70e946384e6daa0ef269c5a8a5fe8fbcd7477c6fac089ebcad801fb3b1ea640b26290f2a8503809
- SSDEEP 6144:nRc2DNDMBl50qO3XKPK+Uh7ECNA3Oh/yhBcKCGEG7v5ofy1T:KuAF0P3XjtECu3Oh/yh7CGEGDWfy
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline sectoprat shop discovery infostealer rat trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

SectopRAT

SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2