General

  • Target

    47f2430250e310fea357dbebaf747611c4d7a9b7c8c4b4f18f57be3346b6c900

  • Size

    274KB

  • Sample

    241109-wvml1azbnr

  • MD5

    becf5d7ac9445b8bfd2fb0caa699126b

  • SHA1

    8b19c1e228b375cdb36b104c69e41d201dfde77b

  • SHA256

    47f2430250e310fea357dbebaf747611c4d7a9b7c8c4b4f18f57be3346b6c900

  • SHA512

    1427a053a769805f9962aab83f97ba91312c6ab3d92eb864d9c2aea77d169b315989dcac36e7fc080fd0f6d55e86f722f3b515ffbfa35e12133e693587fc8327

  • SSDEEP

    6144:2Vyc/lRwyhYo/HLYzVZGD0j7Vll70YZrk7Ak3I8AIL65xD:2Vyc/nwtsYzV4D0j7Vv0ark7Ak3ILb

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

37.228.129.48:29795

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      1a8724ba595f7c5e8c8d46a877f38d6371a7f11c9c04637e91b724e7ff1693b5

    • Size

      426KB

    • MD5

      83674b99d41720e2730628cfb81d13ee

    • SHA1

      3ea206da2c48a79e13e12c29ebbb03097d2b189a

    • SHA256

      1a8724ba595f7c5e8c8d46a877f38d6371a7f11c9c04637e91b724e7ff1693b5

    • SHA512

      ad352e92c721222f0ecdbd86cd24eb741cebb092c7841f5946a49406c5fcc2b68cb49dc4963f4928540346c762e6a92d35161bfb36e0d65db2f93f2935fbaa0c

    • SSDEEP

      12288:Aoci7AQP6hPNbYG6ZMTZJx65rG+tURwps565JBWNOz:LcSihNkxZyJWrFps56fz

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks