General

  • Target

    e16437294548b76c8239929235ba36f696b4350d62921917fa154772a6051665

  • Size

    39KB

  • Sample

    241107-n9td4a1mdy

  • MD5

    f8d277ab832f349c41123d6e565a0f55

  • SHA1

    42c2d14bb758a9ee2dfa15c1bb413b1fb60cb731

  • SHA256

    e16437294548b76c8239929235ba36f696b4350d62921917fa154772a6051665

  • SHA512

    1f6a8a00fe39934782fde5b66d8a1f3a88b606dbcf069ed3cf5fef441af924761ff22e74aca6151639f0b418461bedc9b36f9f08470456c8caee72959fe56e81

  • SSDEEP

    768:NddkLUkBxfxSqTDj7ifauVeRawWQ6q1GFGY+ZofXMpJFsJu+sNGXd8M+krr:oUcfrSCubwW/qtTofctso+sSdZr

Malware Config

Extracted

Family

redline

Botnet

wcmFr5xKM66WkyVK

C2

45.42.45.232:63495

Targets

    • Target

      build.exe

    • Size

      95KB

    • MD5

      de4f38a31cfe068b81d44ef31df79b4f

    • SHA1

      e8c2ef0dca35ddfac021e518d4137a9ef5dad260

    • SHA256

      c6cde24b4b74f8641605f79d56cbea788aef4bc7a60babbd059bad23b0a56242

    • SHA512

      173621b20a197455fea7ce19c9bd1bba6e6f6396f3f8e09efd0cfc126875ff4aef4d6b58bc1655bca30d8ea30e36d4b728609e66ae176fc4d73af8056d49e739

    • SSDEEP

      1536:tgqsscqpJlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2qteulgS6p0:Upe/Y3+zi0ZbYe1g0ujyzdi0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks