General

  • Target

    41d3b3077390a99becd17bd28f9592b07b2b906cb748afc326e0e0857dc4eff1

  • Size

    324KB

  • Sample

    241105-gjjzeawbmc

  • MD5

    c5ff2f53b3c4b12cf44e1be4f151c7ec

  • SHA1

    8f226b52b38f9ca1bdf1e0d24328d86d65c63c17

  • SHA256

    41d3b3077390a99becd17bd28f9592b07b2b906cb748afc326e0e0857dc4eff1

  • SHA512

    9bf6cde8e8b589973d787d523c78662a64ba0a19e82ec74baae56812ae629f19ac68b35caa0d0a787aa265bcff17c97b6034dcb651cd5c4fccced4328eee90c3

  • SSDEEP

    3072:ezJ3kmbxdkRg+yqTAi8ZYI43nPGc+BWflUU5vS/QxhmjYuNSxwgRyCJ5Mu7YWnWB:5RCeAijnSuujFNSiExIRWWCIw

Malware Config

Extracted

Family

redline

Botnet

THEBESTONE

C2

185.215.113.60:1751

Targets

    • Target

      41d3b3077390a99becd17bd28f9592b07b2b906cb748afc326e0e0857dc4eff1

    • Size

      324KB

    • MD5

      c5ff2f53b3c4b12cf44e1be4f151c7ec

    • SHA1

      8f226b52b38f9ca1bdf1e0d24328d86d65c63c17

    • SHA256

      41d3b3077390a99becd17bd28f9592b07b2b906cb748afc326e0e0857dc4eff1

    • SHA512

      9bf6cde8e8b589973d787d523c78662a64ba0a19e82ec74baae56812ae629f19ac68b35caa0d0a787aa265bcff17c97b6034dcb651cd5c4fccced4328eee90c3

    • SSDEEP

      3072:ezJ3kmbxdkRg+yqTAi8ZYI43nPGc+BWflUU5vS/QxhmjYuNSxwgRyCJ5Mu7YWnWB:5RCeAijnSuujFNSiExIRWWCIw

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks