General

  • Target

    f8f717beb9b7de0b20ef86dcabc3a7b107fcfd933daa17899ff95dce53ba6db8

  • Size

    337KB

  • Sample

    241108-vszm4swekk

  • MD5

    a371cb8030ecb71c1246359e86e45fe6

  • SHA1

    8cc4982a22d833799906bd8c9616385142386407

  • SHA256

    f8f717beb9b7de0b20ef86dcabc3a7b107fcfd933daa17899ff95dce53ba6db8

  • SHA512

    8875fb83ce689f5f8dced5cbde2e40cdc9adfbf716f34770bdc747e0ef47d3766c91c1c9c30a1638381617e47bf8650d4909b24822e957102cffc5aa58338100

  • SSDEEP

    6144:0AW7N8YRaM/mfYE3p8YngaiZEN6RwMlkO/ZZof9KgTIADG8el:097N8YRz/iB+YnmwMlBxZyTxD

Malware Config

Extracted

Family

redline

Botnet

netlyvpn evadav

C2

94.103.9.181:25749

Attributes
  • auth_value

    2f7acec700c0507cc87a24aafe1c92fb

Targets

    • Target

      f8f717beb9b7de0b20ef86dcabc3a7b107fcfd933daa17899ff95dce53ba6db8

    • Size

      337KB

    • MD5

      a371cb8030ecb71c1246359e86e45fe6

    • SHA1

      8cc4982a22d833799906bd8c9616385142386407

    • SHA256

      f8f717beb9b7de0b20ef86dcabc3a7b107fcfd933daa17899ff95dce53ba6db8

    • SHA512

      8875fb83ce689f5f8dced5cbde2e40cdc9adfbf716f34770bdc747e0ef47d3766c91c1c9c30a1638381617e47bf8650d4909b24822e957102cffc5aa58338100

    • SSDEEP

      6144:0AW7N8YRaM/mfYE3p8YngaiZEN6RwMlkO/ZZof9KgTIADG8el:097N8YRz/iB+YnmwMlBxZyTxD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks