General

  • Target

    fd91b91e2bde57a03a638d3022510dc0e11e8a71dd39acf913f210cd94d6135a

  • Size

    279KB

  • Sample

    241107-k6h76szdlj

  • MD5

    d5d7bd815fbd1cfb1fd65090326cf98a

  • SHA1

    7220ba79cab0ffedee7ea1e59b6c547921a628d2

  • SHA256

    fd91b91e2bde57a03a638d3022510dc0e11e8a71dd39acf913f210cd94d6135a

  • SHA512

    29fcd13646735c753a14570425ab36524868f3a2a297185817efcaa2dda1850bc8e24f9833b74555e9de2d6157cb662b306791db90df6a4e0e88e66b874f5a9a

  • SSDEEP

    6144:XAJ3u4Bgpt5FBziOx2MEIpVunFbCTkHgVx98aCA/MqaDTff6E:QJ3u46Drb18YH8H

Malware Config

Extracted

Family

redline

Botnet

usamoney

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      fd91b91e2bde57a03a638d3022510dc0e11e8a71dd39acf913f210cd94d6135a

    • Size

      279KB

    • MD5

      d5d7bd815fbd1cfb1fd65090326cf98a

    • SHA1

      7220ba79cab0ffedee7ea1e59b6c547921a628d2

    • SHA256

      fd91b91e2bde57a03a638d3022510dc0e11e8a71dd39acf913f210cd94d6135a

    • SHA512

      29fcd13646735c753a14570425ab36524868f3a2a297185817efcaa2dda1850bc8e24f9833b74555e9de2d6157cb662b306791db90df6a4e0e88e66b874f5a9a

    • SSDEEP

      6144:XAJ3u4Bgpt5FBziOx2MEIpVunFbCTkHgVx98aCA/MqaDTff6E:QJ3u46Drb18YH8H

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks