General

  • Target

    5be4a6322a4d0d698c6e2b29e885c22dbcfc18e6

  • Size

    43KB

  • Sample

    241105-bm7xra1jet

  • MD5

    5f8c4f25231ce4768ffb3f60db0a5597

  • SHA1

    5be4a6322a4d0d698c6e2b29e885c22dbcfc18e6

  • SHA256

    56a279d309df311700e13c4160a135e47bc20c00d2eeca2be4b9a7157928c8d3

  • SHA512

    e60b48e85fea679a92128a3e8286dc18f317a27dc34dbb7c7adde4afd91a4fed8a3fc8d28416492e978ab0d2e39b2022c2c7a93bd2e9ae0c6704896153d24192

  • SSDEEP

    768:aaPtboCBpY7LgLm1qYTJXu4/W3pKk2KRqI7MQ8XYYNFMA1MqjQxt5ait+TCaPqm2:aQbo+4gLmJh/WbFF7MQ8XbXMA1J+3aij

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

109.107.177.164:80

Targets

    • Target

      ff40e436ad1fe50fbea78d589167cb95e6d27202dab850e1189f64a36e84f140.exe

    • Size

      95KB

    • MD5

      e8842f218ebfe2f2432a7955d541a9dc

    • SHA1

      3e5b9dc2fff6cac05396c1a7d9045964b713d294

    • SHA256

      ff40e436ad1fe50fbea78d589167cb95e6d27202dab850e1189f64a36e84f140

    • SHA512

      cd7e82f9ca74debb7918146000730eeef8414c6c68135fd491db3a77c70e442a6d986bbfb7b759519393f7f9e24b68e46cf5511a9889ee7f005251bf43fefce3

    • SSDEEP

      1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2E3tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdGY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks