General

  • Target

    be352eb0d00c66b22e9054fae8c26e485e9c71def3b13c3f86359437107afc3f

  • Size

    43KB

  • Sample

    241109-m69fgawlfr

  • MD5

    789ffcfe3302803cde1ee4bc64817c86

  • SHA1

    26d823a3a73f820a007b5774e184dc0ba7cf55b4

  • SHA256

    be352eb0d00c66b22e9054fae8c26e485e9c71def3b13c3f86359437107afc3f

  • SHA512

    ad159db47cb40820219d2d76b6c1e112f77d1c8cc21b3401cc41a9e5955bf83e2efbe00e1c680f0235cade867d367a0a91d543308b4d824414417f82c3a01fc5

  • SSDEEP

    768:cqUzOteZoel7g75F1bQrZfWC8p3m98+lhKZsP9iqELtY:czzOy7g7zGr8VK8+lhKZs0q+tY

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

127.0.0.1:8636

Targets

    • Target

      a54e55261b9c9eb007475d5d1494192706fb10427de353458f91684353e5c399

    • Size

      95KB

    • MD5

      55b5118806f299237da24deab9f567c4

    • SHA1

      c9cb6e65c2df8e664d8454ef6bca263ff1ce1300

    • SHA256

      a54e55261b9c9eb007475d5d1494192706fb10427de353458f91684353e5c399

    • SHA512

      9fb58eab4716e3013472b531b09ef43131c13d936d9c2a79c8979037a870abff6a040ff6108ee4defa25dde323cd77f958d2d84f5f8ee77cdc1ae4451e06e944

    • SSDEEP

      1536:1qsGfq+TmlbG6jejoigI/43Ywzi0Zb78ivombfexv0ujXyyed2e3tmulgS6pg:z0taY/+zi0ZbYe1g0ujyzdUg

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks