General

  • Target

    ac60f7a9e32582940c6b0feea4461324.bin

  • Size

    43KB

  • Sample

    240902-b4anksxhpp

  • MD5

    f8e8884d85da6964148d9e2d9fae72ee

  • SHA1

    49db434bcffc520b422fb8b20ab3f5d53e3d66fc

  • SHA256

    2e68d82e5fbd22e90655c441db1d48a289fa1174a88713f8272e6d46f7d59503

  • SHA512

    321fca3a3679630dd4ec3cc99d1074bd6ca63bff878cf48a4fecdd0e74e801fe5ff25f5bbfb9a6d2cc69d74193628f85e76d6d33fc1e7e95309ffaa82dd78e1a

  • SSDEEP

    768:G3KRPw16qYlJ0khZ5J3VCyhhXcnhoOtGW9JH5FE1zHezMHBbNXdGn3h:7RzF5XBXcnhoOIWHHTE1SzMHBZXdGR

Malware Config

Extracted

Family

redline

Botnet

h4n0m4n

C2

207.32.219.79:40826

Targets

    • Target

      d5cfec837881ccfbda1d444f31a7c972fe8b465a5a4c5d245f3e03332ab8ad78.exe

    • Size

      96KB

    • MD5

      ac60f7a9e32582940c6b0feea4461324

    • SHA1

      978ce9cb01858df4ccd870553895f8ac31077abb

    • SHA256

      d5cfec837881ccfbda1d444f31a7c972fe8b465a5a4c5d245f3e03332ab8ad78

    • SHA512

      6e93cb44df12efdd89cd3bb6531e96155aac9c1e636659e1b15eedef3deb103e1ccd9c702e070500d9499351ebd0b06883f2f5fa6bf97f1dd759652b27f05fe6

    • SSDEEP

      1536:7G6ijoigjqYdEYwtN1yseWlxdb/B6LZmbfaxvSujXyyedOo4BwgEp:Xsj9ndsSujyzdTp

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks