redline

General

Target
d03222b81ad56bccf72002d565d1bb51bee0544be1e956dde89c90a7c29de6a0
Size 226KB
Sample240831-drta9sshjp
SHA256 d03222b81ad56bccf72002d565d1bb51bee0544be1e956dde89c90a7c29de6a0
MD5 3fabdb3f3bf3cd42d024d6bc7d248a35
SHA1 654254c37e8711248f69cb3ad2b55f109cea49d8
SHA512 083fad5ed27513d40240b449e98d66476fb6a9fb8ac5252d13d11d90b0309177c0204d16425b01ab93b0eb6806110cbb26d544f42a700f9bf22b7f4f75dca982
SSDEEP 6144:V6pt7cXVlHi5u7u2HXX8I6f1PCfkFeCXsD:+4sm73a/8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

sewPalp

C2

185.215.113.29:24645

Attributes

auth_value
41d3df6d093b1e36993abf16af0d6f2d

Targets

- Target
  7295f2d96ac3013c4a20a000616a04fd8d1e0ddfe1ec7520b6b31c7696f2b9f7
- Size 385KB
- SHA256 7295f2d96ac3013c4a20a000616a04fd8d1e0ddfe1ec7520b6b31c7696f2b9f7
- MD5 75db574db87f6d023a9c11d9bef39478
- SHA1 a22e7a0b930fd2d9ab2755f8d15c53c66ac04994
- SHA512 59c822d90d3f6a1bb7045b4f80bbd750cb6be401e235fe285675195b12ca9a0692cba3adb5350ac81390efe535a344190c545d8c6c3be8d9c0f02ff74572a83b
- SSDEEP 6144:Wn4k0sY1s74Hrnce15ptfyFogJvIPKnIm0Gt934XcxCgxPXP:WtJ74HTcenptfyagJgSnIy930dy/
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline sectoprat sewpalp discovery infostealer rat trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

SectopRAT

SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2