General

  • Target

    3edcc0ec50c2959d73c87b462fe165b216a73e4c1a26c3a273e629d0b8a9dc09

  • Size

    231KB

  • Sample

    241106-rpft2stqal

  • MD5

    2898c3ee2940df28c9b1285d7bfceaba

  • SHA1

    2a470263616ae4f7fdba607991c69cf47ef52967

  • SHA256

    3edcc0ec50c2959d73c87b462fe165b216a73e4c1a26c3a273e629d0b8a9dc09

  • SHA512

    833f6726a1a7e7ae8cff438ec733b11ce097e91500b564a0ff63d68fd684c11774e8161733bc78c336f40b30df533fce7464b8e8b4e5c421d5489c649b5c736b

  • SSDEEP

    6144:4FEBkLxk5t/iXbvn4/ZqK1ywTp77Cx0NqChBk:EQF7/ZhywTNUrz

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

188.124.36.242:25802

Targets

    • Target

      1d91ab82e01d7682deecbeef7b441f26e405c0053e0354e92fdb5cfe61b097b0

    • Size

      346KB

    • MD5

      88b7faf82455e5327c3102779677b5de

    • SHA1

      0893f2bea5dc53659f96122798c632b67d45804c

    • SHA256

      1d91ab82e01d7682deecbeef7b441f26e405c0053e0354e92fdb5cfe61b097b0

    • SHA512

      563b1304f6b770c70b14beb90c1866083d3c3472cf3ef7722973d0f133ea87d8b11fd8903c72590612ee35725520c58223343695101b00a8cd0b02de63ba0963

    • SSDEEP

      6144:Gw7AZGWoSvIb16ryqGQSuk9L7RxxTlHHk1rIvn7JojwG5+cOsa93Z:rMboSvc16rAPukp9TBk1Ev7JojwG0c6J

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks