General

  • Target

    b6f3c6ba0d1f648cf432f804fc751989e32f645cad0e5452a57aabf378d31791

  • Size

    283KB

  • Sample

    241108-fy9myawerg

  • MD5

    f9744d9c4bc84fca0d22cd98dd1d4d1d

  • SHA1

    516abe1e7d6066ba1bda8183d6ac72735f420723

  • SHA256

    b6f3c6ba0d1f648cf432f804fc751989e32f645cad0e5452a57aabf378d31791

  • SHA512

    43b0ee73c1bab8b2ec2cc30e14eab943c8018e3ce30629f032bddd9d8f678d7db5bad980af2b780a1fc446d6327102098ccdea7f9bc1fc68e2c5c3277506a725

  • SSDEEP

    6144:Eic3o3qh8n8QDM/FndnYvvi2iT8gnLPtVfFkIm:Pc3o30W8Qopdk62i4g39m

Malware Config

Extracted

Family

redline

Botnet

vvv

C2

178.23.190.12:52475

Targets

    • Target

      b6f3c6ba0d1f648cf432f804fc751989e32f645cad0e5452a57aabf378d31791

    • Size

      283KB

    • MD5

      f9744d9c4bc84fca0d22cd98dd1d4d1d

    • SHA1

      516abe1e7d6066ba1bda8183d6ac72735f420723

    • SHA256

      b6f3c6ba0d1f648cf432f804fc751989e32f645cad0e5452a57aabf378d31791

    • SHA512

      43b0ee73c1bab8b2ec2cc30e14eab943c8018e3ce30629f032bddd9d8f678d7db5bad980af2b780a1fc446d6327102098ccdea7f9bc1fc68e2c5c3277506a725

    • SSDEEP

      6144:Eic3o3qh8n8QDM/FndnYvvi2iT8gnLPtVfFkIm:Pc3o30W8Qopdk62i4g39m

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks