redline

General

Target
141914dc60312935a96e6f280f53d8bf.zip
Size 219KB
Sample240831-tcq6csscqp
SHA256 e77bc777b14390e5fbede7db286a686d426bf1dd7133ea6a2260e2880a5f238d
MD5 964b5f90f9244490ac802a9a7fa6867d
SHA1 b94163a60a5d55f5293a3ae6f993ed0d9a54bb4d
SHA512 549ef860f40e86f023411f29ca6aa067cfc981068d62f4fbf3c10718a35e5ad3bd0bcd85c016653487d308ca9daedc790c95c183afec28a0d41791ffe4740801
SSDEEP 6144:64SoeYP3O6tjLB6Vsm33RisqYt6TPX8GMpfpRI1hR/F:64Su3Xtj16F3Xdt6w7Bgz/F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

sewPalp

C2

185.215.113.29:24645

Attributes

auth_value
41d3df6d093b1e36993abf16af0d6f2d

Targets

- Target
  e65909d22d34d00389e84329d40b0878c37e50e5b252c93a20d5f8a937abb746
- Size 366KB
- SHA256 e65909d22d34d00389e84329d40b0878c37e50e5b252c93a20d5f8a937abb746
- MD5 141914dc60312935a96e6f280f53d8bf
- SHA1 387fa5c25e1eddb3430bda419223ffb95b77c534
- SHA512 1791c16acf30d7fcf14d7e729186a8faa98b3a807f2acb5d3ca7eb23506a7bdb22d55812d93e6fa17c32ca674262cd632e60462d5a9b2f969cb45e674aab03d5
- SSDEEP 6144:9zomTDuu0WqkvY4zXWCd0xadJzJTXjf9N5rZsZ/FagLxBLYR8EreX:tomTCufqN4zmCd02JTXjlbrZsZ/FaYBR
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline sectoprat sewpalp discovery infostealer rat trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

SectopRAT

SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2