General

  • Target

    911e5ae034ce11a769b6251c191b74e3b3f0c31db1cc441edcd0b8af44a87557

  • Size

    412KB

  • Sample

    241107-vx6xzswfrh

  • MD5

    e961db9ca32fb9949942a306cb1885ce

  • SHA1

    378de8802c2b3fce88284e91fa7f0321c429a176

  • SHA256

    911e5ae034ce11a769b6251c191b74e3b3f0c31db1cc441edcd0b8af44a87557

  • SHA512

    8eec7078a3eb15a35aae2324af86e6cd6b7d022b81913675c28ef9fbbea5beddd6df09905a43e824a81039804065588ef8574159894f59c33881a248091d3d44

  • SSDEEP

    6144:VMogVRaY5s4KwOWOSKLY7X1xhwv9UzE6rNdCxAVY0QPcZE7t8T:rgVG4KwOWnKLylnwFUPrWxAVdQkK0

Malware Config

Extracted

Family

redline

Botnet

money

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      911e5ae034ce11a769b6251c191b74e3b3f0c31db1cc441edcd0b8af44a87557

    • Size

      412KB

    • MD5

      e961db9ca32fb9949942a306cb1885ce

    • SHA1

      378de8802c2b3fce88284e91fa7f0321c429a176

    • SHA256

      911e5ae034ce11a769b6251c191b74e3b3f0c31db1cc441edcd0b8af44a87557

    • SHA512

      8eec7078a3eb15a35aae2324af86e6cd6b7d022b81913675c28ef9fbbea5beddd6df09905a43e824a81039804065588ef8574159894f59c33881a248091d3d44

    • SSDEEP

      6144:VMogVRaY5s4KwOWOSKLY7X1xhwv9UzE6rNdCxAVY0QPcZE7t8T:rgVG4KwOWnKLylnwFUPrWxAVdQkK0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks