General

  • Target

    00928317c46d4882e7631a4be1fd5e54ad3353229fe7610d5a33475abb299b24N

  • Size

    95KB

  • Sample

    241107-tknefavlay

  • MD5

    fa08dc70f1d051baffb02f9b661821c0

  • SHA1

    40b6cd17e74ce001590d59c2543978e9decbc323

  • SHA256

    00928317c46d4882e7631a4be1fd5e54ad3353229fe7610d5a33475abb299b24

  • SHA512

    e68d67d85c9681cf8b75ba3553e1e335e47d78309be4a5bdb18320b99fe6f5485763987e354e1b8417389e7557853eddf65e8812a00b7a525ce42f7261d1507f

  • SSDEEP

    1536:xqs+1tqzClbG6jejoigIr43Ywzi0Zb78ivombfexv0ujXyyed2/tmulgS6pkn:fCtAyYr+zi0ZbYe1g0ujyzd/kn

Malware Config

Extracted

Family

redline

Botnet

nwa

C2

94.141.120.6:55123

Targets

    • Target

      00928317c46d4882e7631a4be1fd5e54ad3353229fe7610d5a33475abb299b24N

    • Size

      95KB

    • MD5

      fa08dc70f1d051baffb02f9b661821c0

    • SHA1

      40b6cd17e74ce001590d59c2543978e9decbc323

    • SHA256

      00928317c46d4882e7631a4be1fd5e54ad3353229fe7610d5a33475abb299b24

    • SHA512

      e68d67d85c9681cf8b75ba3553e1e335e47d78309be4a5bdb18320b99fe6f5485763987e354e1b8417389e7557853eddf65e8812a00b7a525ce42f7261d1507f

    • SSDEEP

      1536:xqs+1tqzClbG6jejoigIr43Ywzi0Zb78ivombfexv0ujXyyed2/tmulgS6pkn:fCtAyYr+zi0ZbYe1g0ujyzd/kn

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks