General

  • Target

    7ef9d397be83b68a96c96b0ecc0ec3b9

  • Size

    44KB

  • Sample

    241108-ezyrdsvkfw

  • MD5

    7ef9d397be83b68a96c96b0ecc0ec3b9

  • SHA1

    521d9f80e59b671ce9ef664f76f8dd399061d6e4

  • SHA256

    105efd1db17d2a8e58d2f0fa96208bccbb7c330099d6ca66ffc39d63189aea83

  • SHA512

    84b1e72046ec25293ca027b82d0c18afc905e33bf5f31f6cfd8bb052739cac023682097ab792dc1e6dcbfaa94d070bef796379022d48fa4940b624605c69f3e0

  • SSDEEP

    768:Nq3sOw8xf0x3YSEiXirD7lgIjB9ZqDuqR3Cucv+7C1Dk4lLLpods538xZ:xO5xf01YSEioD7lgIjHADuqhCucvo4FO

Malware Config

Extracted

Family

redline

Botnet

peace

C2

154.127.53.77:26061

Targets

    • Target

      fcc7eb446093f092eec4f1ba25b2608e77326b3e12df5680963504b96afc01f6.exe

    • Size

      95KB

    • MD5

      4b36463bd9f54a58c8085e92b98b0593

    • SHA1

      235d11a3452eb848dedf64d6eaef01f47b7de57e

    • SHA256

      fcc7eb446093f092eec4f1ba25b2608e77326b3e12df5680963504b96afc01f6

    • SHA512

      bafb212479e5523fdca3947b043f1e7fc6a3f62a0f62aa3694b1d33ef9f16bb930a75bf9af93a07f5da542079926f7f0844410fc25b41b8e1ef075fc610c118f

    • SSDEEP

      1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2steulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdcY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks