redline

General

Target
ac60f7a9e32582940c6b0feea4461324.bin
Size 43KB
Sample240902-b4anksxhpp
SHA256 2e68d82e5fbd22e90655c441db1d48a289fa1174a88713f8272e6d46f7d59503
MD5 f8e8884d85da6964148d9e2d9fae72ee
SHA1 49db434bcffc520b422fb8b20ab3f5d53e3d66fc
SHA512 321fca3a3679630dd4ec3cc99d1074bd6ca63bff878cf48a4fecdd0e74e801fe5ff25f5bbfb9a6d2cc69d74193628f85e76d6d33fc1e7e95309ffaa82dd78e1a
SSDEEP 768:G3KRPw16qYlJ0khZ5J3VCyhhXcnhoOtGW9JH5FE1zHezMHBbNXdGn3h:7RzF5XBXcnhoOIWHHTE1SzMHBZXdGR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

h4n0m4n

C2

207.32.219.79:40826

Targets

- Target
  d5cfec837881ccfbda1d444f31a7c972fe8b465a5a4c5d245f3e03332ab8ad78.exe
- Size 96KB
- SHA256 d5cfec837881ccfbda1d444f31a7c972fe8b465a5a4c5d245f3e03332ab8ad78
- MD5 ac60f7a9e32582940c6b0feea4461324
- SHA1 978ce9cb01858df4ccd870553895f8ac31077abb
- SHA512 6e93cb44df12efdd89cd3bb6531e96155aac9c1e636659e1b15eedef3deb103e1ccd9c702e070500d9499351ebd0b06883f2f5fa6bf97f1dd759652b27f05fe6
- SSDEEP 1536:7G6ijoigjqYdEYwtN1yseWlxdb/B6LZmbfaxvSujXyyedOo4BwgEp:Xsj9ndsSujyzdTp
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline sectoprat h4n0m4n discovery infostealer rat trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

SectopRAT

SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2