General

  • Target

    d7f306b6e3eb0c8edad6cad77b88559b025f6777db233456111cd4851e21a806

  • Size

    342KB

  • Sample

    241108-wsxn7awlfw

  • MD5

    bb30c4cb500444e78f28650c9d241bce

  • SHA1

    f8aac7ac17acf1091d9bc0fd67822d0fba95609c

  • SHA256

    d7f306b6e3eb0c8edad6cad77b88559b025f6777db233456111cd4851e21a806

  • SHA512

    39a43ca3922e5eb6f04a9b06075c30688099d0bba1de22a85aa1a1df25478a0cb1abb16e2efc0f8ec0c53b1af6d802414822a88576d9d304ee9cae022ba90db8

  • SSDEEP

    6144:XaG/AUErZNu5xdBZ3PfgMDflUfWNyWdVEZp4IEDauBsj9JsxWBfO:KG/AUeyxVfgaflXZc4IEDkjzm0f

Malware Config

Extracted

Family

redline

Botnet

test

C2

193.56.146.78:51487

Targets

    • Target

      d7f306b6e3eb0c8edad6cad77b88559b025f6777db233456111cd4851e21a806

    • Size

      342KB

    • MD5

      bb30c4cb500444e78f28650c9d241bce

    • SHA1

      f8aac7ac17acf1091d9bc0fd67822d0fba95609c

    • SHA256

      d7f306b6e3eb0c8edad6cad77b88559b025f6777db233456111cd4851e21a806

    • SHA512

      39a43ca3922e5eb6f04a9b06075c30688099d0bba1de22a85aa1a1df25478a0cb1abb16e2efc0f8ec0c53b1af6d802414822a88576d9d304ee9cae022ba90db8

    • SSDEEP

      6144:XaG/AUErZNu5xdBZ3PfgMDflUfWNyWdVEZp4IEDauBsj9JsxWBfO:KG/AUeyxVfgaflXZc4IEDkjzm0f

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks