General

  • Target

    c9b0e483c2da25ee7d0373fe7d08fcccf72e297b2ce6f2d247ee80c31532b6af

  • Size

    563KB

  • Sample

    241107-rfd9vstdrr

  • MD5

    79b66b66121d20f55e665c37088ce3b4

  • SHA1

    780f90288226d93930a8a9b88aabec2d1d0ba985

  • SHA256

    c9b0e483c2da25ee7d0373fe7d08fcccf72e297b2ce6f2d247ee80c31532b6af

  • SHA512

    1103b9f0e88de9efeaef6da570f4a12be7eef5d3f392a6872a9045cfbc7a3992850d3a6d430f3cfe38ac421a348d74e75d7608e3c855128382b4002129552a75

  • SSDEEP

    12288:EPlW+xel/AiR3nyGf3KXrYfTGs5u7ijlAsnme+hENndpgDFU/fGr1Pc:ENdxAJyx/mqe+a1cJkY2

Malware Config

Extracted

Family

redline

C2

89.41.26.185:49115

Targets

    • Target

      6868e16886a76b94bb06530de0824102

    • Size

      4.4MB

    • MD5

      6868e16886a76b94bb06530de0824102

    • SHA1

      9561f6032df93c9bfeba7e0b7569205ca4c08494

    • SHA256

      85a34b22de48d67cc0a3f669704ad180a2b230739bca0c163592aff05e4ab061

    • SHA512

      58b2f7496347bca9956b1d9a77b6e6ecf2266677eef5079daa21f7d7f3bea4008004d908cdce7215d0cdd520b3787c03de053565bb21be160b4dc9aa9849ff9e

    • SSDEEP

      12288:eHXjFFlqzTzIuKba6tmsynwzuLahORU8tk7DovbkSSlGZ7mSRWw704z8:OA7dHRQ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks