General

  • Target

    dcececec2d0505caff736903025f94774d783363553e43de1f31388ca9edcda1

  • Size

    43KB

  • Sample

    241108-he3rdswrex

  • MD5

    b0a3c598f5b87270857580e8e16efb64

  • SHA1

    b9f73f1b2b9daeac0186cbd4459f5b3cb5630db4

  • SHA256

    dcececec2d0505caff736903025f94774d783363553e43de1f31388ca9edcda1

  • SHA512

    ac6d992feae667188932e68d331091a287b0d807ded62597d3862bc39692daa4aaffe994cacb16db8095b0c6da6cfa077dcd635bf9f2ff6c94c7f0a5c4cc8612

  • SSDEEP

    768:6D5oFIozrEbgy66FM1hDfBzrkDV6iS5b1IEYY8SLhLe28hmk7+mcf:6D2IeSBi1hmDVvSMZY8r+kFC

Malware Config

Extracted

Family

redline

Botnet

Setup

C2

136.175.8.52:29509

Targets

    • Target

      a55b390780a73c57def061b3d575f952e96221dab4e04d8f4b8bf213f624d3e0.exe

    • Size

      95KB

    • MD5

      5a3d9c32d142037f35e6d4ba77654352

    • SHA1

      7e6e7f85ed9b5f15dc66f5125e2490f4345ee99e

    • SHA256

      a55b390780a73c57def061b3d575f952e96221dab4e04d8f4b8bf213f624d3e0

    • SHA512

      d5b278933f418fb46302ba7a0a8492777abaaf7c6c09035abb89fb21ebe021ea6811933d6e87766264546e11cc81847c8e4167678a9c362387f8ac45bf5b7d34

    • SSDEEP

      1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2TtmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdbY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks