General

  • Target

    2678a19a8339b352f3bceaa9197723fc2d3412e134cea5fb02aadcecdcb4fc55

  • Size

    375KB

  • Sample

    241110-azr7dswbng

  • MD5

    5c6f9ebce572d2fd0e39aa838f681c51

  • SHA1

    63479ec17a6c01b3ec0ef2f21ee918298e6005d6

  • SHA256

    2678a19a8339b352f3bceaa9197723fc2d3412e134cea5fb02aadcecdcb4fc55

  • SHA512

    98735e9b944b55a13d424327712d6d1d45e36ced89949c71a254ba3b4452680704f23f83fc2cbe8c3d3f13eba1c12a1425c3ec78a7e89a4274b39bf261a9c963

  • SSDEEP

    6144:BsbLFQus8qIFVRV/7aLsE+b7H715OGFgcdnhnpvykCM6TFDxv7:cius8VFVb77E+veIgCpvykp6TFp

Malware Config

Extracted

Family

redline

Botnet

sexwithboti

C2

195.149.87.55:3741

Targets

    • Target

      2678a19a8339b352f3bceaa9197723fc2d3412e134cea5fb02aadcecdcb4fc55

    • Size

      375KB

    • MD5

      5c6f9ebce572d2fd0e39aa838f681c51

    • SHA1

      63479ec17a6c01b3ec0ef2f21ee918298e6005d6

    • SHA256

      2678a19a8339b352f3bceaa9197723fc2d3412e134cea5fb02aadcecdcb4fc55

    • SHA512

      98735e9b944b55a13d424327712d6d1d45e36ced89949c71a254ba3b4452680704f23f83fc2cbe8c3d3f13eba1c12a1425c3ec78a7e89a4274b39bf261a9c963

    • SSDEEP

      6144:BsbLFQus8qIFVRV/7aLsE+b7H715OGFgcdnhnpvykCM6TFDxv7:cius8VFVb77E+veIgCpvykp6TFp

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks