General

  • Target

    861587d63b62c03d49cfe50a783abd5c8b06b0cc470bf0f5316bda799360cb40

  • Size

    384KB

  • Sample

    241110-genrsstnhr

  • MD5

    2c6b0d568a60a6157ea9511ede82c0b8

  • SHA1

    4facac67dd24177426a90299ebecef5db6e1c5cd

  • SHA256

    861587d63b62c03d49cfe50a783abd5c8b06b0cc470bf0f5316bda799360cb40

  • SHA512

    40ecf7f04ca5aa16e3d8b56d71506089c69fb9b8922f39837bf36529637063b94d6f302d80aeefcec635c39efd297b5ff65637d36d7b9d87c0cbb1439c109a4d

  • SSDEEP

    6144:X2TZ8kYRUluLh4QgJYNFgphjNJz7vO/Dng+bSwUwhNpw8DLnOkt:G8RReuOQgwgjjXz7G7ng+vdhNe2h

Malware Config

Extracted

Family

redline

Botnet

usamoney

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      861587d63b62c03d49cfe50a783abd5c8b06b0cc470bf0f5316bda799360cb40

    • Size

      384KB

    • MD5

      2c6b0d568a60a6157ea9511ede82c0b8

    • SHA1

      4facac67dd24177426a90299ebecef5db6e1c5cd

    • SHA256

      861587d63b62c03d49cfe50a783abd5c8b06b0cc470bf0f5316bda799360cb40

    • SHA512

      40ecf7f04ca5aa16e3d8b56d71506089c69fb9b8922f39837bf36529637063b94d6f302d80aeefcec635c39efd297b5ff65637d36d7b9d87c0cbb1439c109a4d

    • SSDEEP

      6144:X2TZ8kYRUluLh4QgJYNFgphjNJz7vO/Dng+bSwUwhNpw8DLnOkt:G8RReuOQgwgjjXz7G7ng+vdhNe2h

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks