General

  • Target

    3dd466ffa2e7031457a79668f0bc129dd21a6ddfa77e95c8438089d63c4e5a8c

  • Size

    978KB

  • Sample

    240924-zgdzgsvajl

  • MD5

    0180e157cb9930ea356bf763647bd67d

  • SHA1

    c7d1c7747628398f6f5812bed3e53c77e0a72ad5

  • SHA256

    3dd466ffa2e7031457a79668f0bc129dd21a6ddfa77e95c8438089d63c4e5a8c

  • SHA512

    07965ffa7103bcf3671533aa8ebf990d309e10da37bfa77741690beafa10a5863500889119c9317b118a2927a8ea1ffa564c30c03cdbe5bf51576bab4e8930a3

  • SSDEEP

    12288:cR5m3dzJ6vBQDSznYU5hlQmn5Ph5SpYkdtsKLYSMclrarAf:N9sQDSz3eoh5SpYkrjZarAf

Malware Config

Extracted

Family

redline

Botnet

lovato

C2

57.128.132.216:55123

Targets

    • Target

      3dd466ffa2e7031457a79668f0bc129dd21a6ddfa77e95c8438089d63c4e5a8c

    • Size

      978KB

    • MD5

      0180e157cb9930ea356bf763647bd67d

    • SHA1

      c7d1c7747628398f6f5812bed3e53c77e0a72ad5

    • SHA256

      3dd466ffa2e7031457a79668f0bc129dd21a6ddfa77e95c8438089d63c4e5a8c

    • SHA512

      07965ffa7103bcf3671533aa8ebf990d309e10da37bfa77741690beafa10a5863500889119c9317b118a2927a8ea1ffa564c30c03cdbe5bf51576bab4e8930a3

    • SSDEEP

      12288:cR5m3dzJ6vBQDSznYU5hlQmn5Ph5SpYkdtsKLYSMclrarAf:N9sQDSz3eoh5SpYkrjZarAf

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks