General

  • Target

    3b67f0f26ffadf84f78ec8bb306a5e7a9b7ff979de961122a698b6a0b567291a

  • Size

    333KB

  • Sample

    241105-b9b4lavjdq

  • MD5

    cf50f7ed4decc24ffad37b91340d085c

  • SHA1

    9eba3548e2378f61048ce83e27b2053d88d24b56

  • SHA256

    3b67f0f26ffadf84f78ec8bb306a5e7a9b7ff979de961122a698b6a0b567291a

  • SHA512

    22ed9d491279e81ebca338c822637a1ba7a9d1b3dd5688471b19a4504f7fd7599a44b7bed555d314e1da6432a7b302ad99817d26fb709bd02cf40086f695b612

  • SSDEEP

    6144:u8YypaxZA/njoUdj+5e2/JJqws3yaCchk7w7XKEkgr4A4r:yIaxuvjoO+5ecrqwvchkOHkVAG

Malware Config

Extracted

Family

redline

Botnet

MESSI22

C2

74.119.195.242:18417

Targets

    • Target

      3b67f0f26ffadf84f78ec8bb306a5e7a9b7ff979de961122a698b6a0b567291a

    • Size

      333KB

    • MD5

      cf50f7ed4decc24ffad37b91340d085c

    • SHA1

      9eba3548e2378f61048ce83e27b2053d88d24b56

    • SHA256

      3b67f0f26ffadf84f78ec8bb306a5e7a9b7ff979de961122a698b6a0b567291a

    • SHA512

      22ed9d491279e81ebca338c822637a1ba7a9d1b3dd5688471b19a4504f7fd7599a44b7bed555d314e1da6432a7b302ad99817d26fb709bd02cf40086f695b612

    • SSDEEP

      6144:u8YypaxZA/njoUdj+5e2/JJqws3yaCchk7w7XKEkgr4A4r:yIaxuvjoO+5ecrqwvchkOHkVAG

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks