General

  • Target

    58f75d0388f4ea748d4a5d4c7c6bf53c218098c872b6d3ccc44e43464670fce1

  • Size

    95KB

  • Sample

    241106-p7tshssqfr

  • MD5

    092d852c3da9636700fadfe6ecc08307

  • SHA1

    141ad4887d8b921b73608aa7589d523c8c9f155d

  • SHA256

    58f75d0388f4ea748d4a5d4c7c6bf53c218098c872b6d3ccc44e43464670fce1

  • SHA512

    e671fc7af4f448d2ac68c78200af5d1cc719df3bb5aa647bd2e99b280423223d5bdc2a591b34adf8ab756ad5f2bea36753630680c016fe75ce9d234b69562b59

  • SSDEEP

    1536:xqswjlqzWlbG6jejoigIr43Ywzi0Zb78ivombfexv0ujXyyed2QteulgS6pk:fMUeYr+zi0ZbYe1g0ujyzdYk

Malware Config

Extracted

Family

redline

Botnet

TH3EVIL

C2

127.0.0.1:16491

Targets

    • Target

      58f75d0388f4ea748d4a5d4c7c6bf53c218098c872b6d3ccc44e43464670fce1

    • Size

      95KB

    • MD5

      092d852c3da9636700fadfe6ecc08307

    • SHA1

      141ad4887d8b921b73608aa7589d523c8c9f155d

    • SHA256

      58f75d0388f4ea748d4a5d4c7c6bf53c218098c872b6d3ccc44e43464670fce1

    • SHA512

      e671fc7af4f448d2ac68c78200af5d1cc719df3bb5aa647bd2e99b280423223d5bdc2a591b34adf8ab756ad5f2bea36753630680c016fe75ce9d234b69562b59

    • SSDEEP

      1536:xqswjlqzWlbG6jejoigIr43Ywzi0Zb78ivombfexv0ujXyyed2QteulgS6pk:fMUeYr+zi0ZbYe1g0ujyzdYk

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks