General

  • Target

    db1530bc11342d50bd8b2b25e8ea3ebf31bbbf947b62a18dd01babbcf2ef132b

  • Size

    39KB

  • Sample

    241105-a5yw5a1cke

  • MD5

    78831460bff74e2bd63248fe3d5b8658

  • SHA1

    d2c2fc757d08d283ea093b5a6f7ec9a92b0793ea

  • SHA256

    db1530bc11342d50bd8b2b25e8ea3ebf31bbbf947b62a18dd01babbcf2ef132b

  • SHA512

    0b1149ccd5cc8d72359472b410d47622c616e00e617924a4cdfaed766876288403a5d50ea9094fe33533475d1714fb359f348b85279747e36b423390e977e944

  • SSDEEP

    768:g5gijLqulGyy47UBOvi60aYc9jtiFGY+dhpJpEAtZiPh9mDqk7QxMg1NnG:OgqLXGybbb5jtDhxEAtZ69Oqk7wMgPG

Malware Config

Extracted

Family

redline

Botnet

wcmFr5xKM66WkyVK

C2

127.0.0.1:63495

Targets

    • Target

      testprogram.exe

    • Size

      95KB

    • MD5

      c57e483a313a45fb26581c086e78b3bb

    • SHA1

      f15e8e2eb59e5ff0b39a9f73278a52afcbcadae4

    • SHA256

      0e0d88585f492f3dd7c45b029fc0803be868779d86a66cf89144b20a276b15d6

    • SHA512

      7ba638c5ac468b2b09a0eb7cbce0060517fd8b315de351431528c74d6002ce173d2747ad7f475428688af50c23ee6d06b9b1618bda3813f2c287163bcb3a0eb3

    • SSDEEP

      1536:aqs8uqBXlbG6jejoigIL43Ywzi0Zb78ivombfexv0ujXyyed2ktmulgS6pw:IvilYL+zi0ZbYe1g0ujyzdQw

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks