General

  • Target

    65a4e2e628f240db8767bd8848113cc85cdd43cafd73ec1f08178ae8a6b5e5a1

  • Size

    356KB

  • Sample

    241109-18mw5swngn

  • MD5

    7c3d08ab71d3eb30f8c72f11d4bdd84b

  • SHA1

    157f29e53a316c9cf7f0b7c5537ee274fde6ae7b

  • SHA256

    65a4e2e628f240db8767bd8848113cc85cdd43cafd73ec1f08178ae8a6b5e5a1

  • SHA512

    23008d193e6a02892b760c092b5899f78b7fb82bf2bedc6f40f15288309bea46203c37b7a725de492f7ced7556d059be16e133d9d8d152fef585c4f46c8d05e3

  • SSDEEP

    6144:6SQA8wBSmmaL+N1cZp0oHGAhW+Nq+RWezqsmFLSn0zl19pDJO:IA8wBSmTLqcZpZnhW+DUGn0B19b

Malware Config

Extracted

Family

redline

Botnet

build

C2

185.244.182.136:51832

Attributes
  • auth_value

    275ce2c87153d4e8e3cc276c686a93de

Targets

    • Target

      65a4e2e628f240db8767bd8848113cc85cdd43cafd73ec1f08178ae8a6b5e5a1

    • Size

      356KB

    • MD5

      7c3d08ab71d3eb30f8c72f11d4bdd84b

    • SHA1

      157f29e53a316c9cf7f0b7c5537ee274fde6ae7b

    • SHA256

      65a4e2e628f240db8767bd8848113cc85cdd43cafd73ec1f08178ae8a6b5e5a1

    • SHA512

      23008d193e6a02892b760c092b5899f78b7fb82bf2bedc6f40f15288309bea46203c37b7a725de492f7ced7556d059be16e133d9d8d152fef585c4f46c8d05e3

    • SSDEEP

      6144:6SQA8wBSmmaL+N1cZp0oHGAhW+Nq+RWezqsmFLSn0zl19pDJO:IA8wBSmTLqcZpZnhW+DUGn0B19b

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks