General

  • Target

    1fde52ea0618bbae9db758e8d1ba86c0

  • Size

    43KB

  • Sample

    241108-t8w2gsvhnb

  • MD5

    1fde52ea0618bbae9db758e8d1ba86c0

  • SHA1

    5d2dd2475b06045c354812d7281714ceddd3239d

  • SHA256

    f9d90a8bf17e15970cf1836f10f75e1cf3f3626eeb46a99f54e3863b35407cc4

  • SHA512

    b5a814b4304ea744da2219804806ded273e1d8ea6581a25306551b4ad907b45f809dd00c41603e979c2d651cd9e660a4e2ebfd31e0dcb16d5684f5303bc0685f

  • SSDEEP

    768:349Kzkdb6sEZmN0mYxB/hmfE8dwPib8iCAjFqUnXjFuCQVsiRjSopv4cxTT:349DTN0mAhm1d1AiCAjQ4XpuCQVyvAT

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

109.107.177.164:80

Targets

    • Target

      ff40e436ad1fe50fbea78d589167cb95e6d27202dab850e1189f64a36e84f140.exe

    • Size

      95KB

    • MD5

      e8842f218ebfe2f2432a7955d541a9dc

    • SHA1

      3e5b9dc2fff6cac05396c1a7d9045964b713d294

    • SHA256

      ff40e436ad1fe50fbea78d589167cb95e6d27202dab850e1189f64a36e84f140

    • SHA512

      cd7e82f9ca74debb7918146000730eeef8414c6c68135fd491db3a77c70e442a6d986bbfb7b759519393f7f9e24b68e46cf5511a9889ee7f005251bf43fefce3

    • SSDEEP

      1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2E3tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdGY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks