General

  • Target

    974d7d6c142b2febd7cff47ba9b6ad8bf6b396b9ee6fc0d7d6f8b94ead8b3ffd

  • Size

    44KB

  • Sample

    241108-lb7sqazfmn

  • MD5

    9f11f77e84a40d8c803ab8d82e5e500a

  • SHA1

    4e38aafb2d80b8cfd46debf4b16e77186998a983

  • SHA256

    974d7d6c142b2febd7cff47ba9b6ad8bf6b396b9ee6fc0d7d6f8b94ead8b3ffd

  • SHA512

    d7ee48ccbac7c2c2f3135047745f8db69436715c2c3cf933fa33226a2b1cd5782ed5f9d956857002a6966dabef6a7ec32af3f855c56ade3268d23602fd7aed36

  • SSDEEP

    768:fpWd40Pq9Wt3uaoXEPuWQ7aorhvAXfIs4keRbMdvSDTCi70GlxjyNE0jBscDd:hWdw9CvoUmhaotoXgsKbBb70uZiP9N5

Malware Config

Extracted

Family

redline

Botnet

BL

C2

193.233.49.109:22285

Targets

    • Target

      d7f94c05f6d679ea0df97e773ee754166ecee640bd2b93e2b533bab9568cae84.exe

    • Size

      1.0MB

    • MD5

      7ecbba643628f94ba19830291265d89c

    • SHA1

      03cf7509b4864f9d7f47ef65a47560083c4446e1

    • SHA256

      d7f94c05f6d679ea0df97e773ee754166ecee640bd2b93e2b533bab9568cae84

    • SHA512

      2926e805d5e21b6a99a1ac7b817a65f9611a7152563a4e0b58fe76c389297c4e64dbc7fb301d95d94592f3db4a2cc818a9283ce7db471b89c7d3e0af3ca2ee6a

    • SSDEEP

      1536:aqsAPqX6lbG6jejoigIL43Ywzi0Zb78ivombfexv0ujXyyed2pteulgS6pw:IeA6YL+zi0ZbYe1g0ujyzd1w

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks