General

  • Target

    375334c5e526ed00b736713f64099069097d362ab7edcfe07311cf0136b46cde

  • Size

    46KB

  • Sample

    241107-dpklcathna

  • MD5

    eb04adf83f621a03707c5ebd74ca9ca7

  • SHA1

    fb639907a018fbc8c9250533110c3417ca0e2d7c

  • SHA256

    375334c5e526ed00b736713f64099069097d362ab7edcfe07311cf0136b46cde

  • SHA512

    57a3d0f06c9bfa22aa52a9b66d773a7be0dd4978a96399a52d041a3da51780b1051461a06418c4fefd50f51ef8df10239356d27f3b69eca03cf30c2702fca819

  • SSDEEP

    768:iuqsM/Z9zsgkBMpTAuev6aJgj4tsnipRnndEQIT+7M88bBvv2QqVz8rc:dS/XzsJMdevnJxGni/nnddC+488bdvrY

Malware Config

Extracted

Family

redline

Botnet

@treeline300

C2

45.137.190.170:19896

Targets

    • Target

      75da761b015ffe64c01e191a864fd234393e6687462df33649ea42b97cbe47a4.exe

    • Size

      104KB

    • MD5

      8d8d7d4aba4420af2e126800a3139dd8

    • SHA1

      4c3cbb2df4e8b7c7fde6ab7d5f7029ce2b4d5437

    • SHA256

      75da761b015ffe64c01e191a864fd234393e6687462df33649ea42b97cbe47a4

    • SHA512

      340e5de5bd57be15b19acbed186ebf0ae9452ab58e6671b3d04e43729dd76e57bdb177a6a418d6ca173d0408edbb7613799ef6043e3faccde20c387467069007

    • SSDEEP

      3072:UXqrF3iohjoAOjyAofbmhED0ymd/AZp1W:HOmbmhEgyM+

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks