General

  • Target

    00d1808ab6fe2dcf44b2cfed08e5de3367a8d444eb73b0b2e986aa78116b5ab3

  • Size

    279KB

  • Sample

    241106-jqc6jswenc

  • MD5

    3dbf206a5aa432fbca1f184cca93c658

  • SHA1

    cf2bad5ed025a969389878905f03258e3de266d7

  • SHA256

    00d1808ab6fe2dcf44b2cfed08e5de3367a8d444eb73b0b2e986aa78116b5ab3

  • SHA512

    009122b6f446e133680444ea15a998aecc27889c7d1c6782768cc1b0e01f05fb91e4e13ad64d02f8fede5194c06450b9b89a197e2c7b65dc4b4480801bd40cb5

  • SSDEEP

    6144:Dpx+11SsDmAfnZUBllgqS4rdtaGw43VH/0Vx98aCYkI1YE:X+11S7OZqmqS4dt51lqH83I

Malware Config

Extracted

Family

redline

Botnet

usamoney

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      00d1808ab6fe2dcf44b2cfed08e5de3367a8d444eb73b0b2e986aa78116b5ab3

    • Size

      279KB

    • MD5

      3dbf206a5aa432fbca1f184cca93c658

    • SHA1

      cf2bad5ed025a969389878905f03258e3de266d7

    • SHA256

      00d1808ab6fe2dcf44b2cfed08e5de3367a8d444eb73b0b2e986aa78116b5ab3

    • SHA512

      009122b6f446e133680444ea15a998aecc27889c7d1c6782768cc1b0e01f05fb91e4e13ad64d02f8fede5194c06450b9b89a197e2c7b65dc4b4480801bd40cb5

    • SSDEEP

      6144:Dpx+11SsDmAfnZUBllgqS4rdtaGw43VH/0Vx98aCYkI1YE:X+11S7OZqmqS4dt51lqH83I

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks