General

  • Target

    bad3c8aab153b4932bfa09c0f94ecf31a0f70fdc

  • Size

    95KB

  • Sample

    241104-sx3t8asbkh

  • MD5

    783f5a994b064b871af931a8819df41e

  • SHA1

    bad3c8aab153b4932bfa09c0f94ecf31a0f70fdc

  • SHA256

    9c545ce3e9ec3ef19ad002171802b7037816ea24a4c48c1cb9b37734dd17145e

  • SHA512

    bd0c18de286f2c25b841f8cf09f343ff5695bcba16bc9a9c27cccf24328456b080de65c2bbb2c7a183d1204cc90d485db44630e81efd3a5c154e1fc2de7ea6ab

  • SSDEEP

    1536:aqsEwqR7lbG6jejoigIL43Ywzi0Zb78ivombfexv0ujXyyed2NteulgS6pw:IVmRYL+zi0ZbYe1g0ujyzdJw

Malware Config

Extracted

Family

redline

Botnet

Not A Virus

C2

color-premises.at.playit.gg:54400

Targets

    • Target

      bad3c8aab153b4932bfa09c0f94ecf31a0f70fdc

    • Size

      95KB

    • MD5

      783f5a994b064b871af931a8819df41e

    • SHA1

      bad3c8aab153b4932bfa09c0f94ecf31a0f70fdc

    • SHA256

      9c545ce3e9ec3ef19ad002171802b7037816ea24a4c48c1cb9b37734dd17145e

    • SHA512

      bd0c18de286f2c25b841f8cf09f343ff5695bcba16bc9a9c27cccf24328456b080de65c2bbb2c7a183d1204cc90d485db44630e81efd3a5c154e1fc2de7ea6ab

    • SSDEEP

      1536:aqsEwqR7lbG6jejoigIL43Ywzi0Zb78ivombfexv0ujXyyed2NteulgS6pw:IVmRYL+zi0ZbYe1g0ujyzdJw

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks