General

  • Target

    b3a4330a05ce1d6ff4afc0378d5aaf74cac229a2ba569825da1e5fe18a7d7240

  • Size

    360KB

  • Sample

    241107-qyfpzatbjg

  • MD5

    549f0f4c6e5d83ad1c6c9e49c4f31b31

  • SHA1

    9e549ad0fb4b25039c919eb6ebb411fb346e8a12

  • SHA256

    b3a4330a05ce1d6ff4afc0378d5aaf74cac229a2ba569825da1e5fe18a7d7240

  • SHA512

    f8ab163783fe556eabf511ea3ecf3b4548c1455ef15110fdd24d9487ea08fe7e123c845878c4120cd040dc5e1fde60403b1be8523d9f0706745b4f3d2e967b9f

  • SSDEEP

    6144:xuzyu9fp7pd9z0cuCmK8fdBllIoXC5nhI2e/gm4jaL4:AN9R1d9zYCmK8HfN4m2Wgmo

Malware Config

Extracted

Family

redline

Botnet

MESSI22

C2

74.119.195.242:18417

Targets

    • Target

      b3a4330a05ce1d6ff4afc0378d5aaf74cac229a2ba569825da1e5fe18a7d7240

    • Size

      360KB

    • MD5

      549f0f4c6e5d83ad1c6c9e49c4f31b31

    • SHA1

      9e549ad0fb4b25039c919eb6ebb411fb346e8a12

    • SHA256

      b3a4330a05ce1d6ff4afc0378d5aaf74cac229a2ba569825da1e5fe18a7d7240

    • SHA512

      f8ab163783fe556eabf511ea3ecf3b4548c1455ef15110fdd24d9487ea08fe7e123c845878c4120cd040dc5e1fde60403b1be8523d9f0706745b4f3d2e967b9f

    • SSDEEP

      6144:xuzyu9fp7pd9z0cuCmK8fdBllIoXC5nhI2e/gm4jaL4:AN9R1d9zYCmK8HfN4m2Wgmo

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks