General

  • Target

    24d03a9289b793d018fd67839265258ca38c5398a8e55e0882ca75a9053a7e25

  • Size

    139KB

  • Sample

    241110-rzsllaydqk

  • MD5

    13f9662a23420cef71cba907cb4efd17

  • SHA1

    ae44441777f69f307e02a0310ed62b3a76a19b82

  • SHA256

    24d03a9289b793d018fd67839265258ca38c5398a8e55e0882ca75a9053a7e25

  • SHA512

    9c0c943bbc49706970ab4d75702b1afb467dc47f1e716e02c766b4cfed2f49d4d9a54db9526da56a5953ad3b450602102f54ec09eca83f33a596bd08d3f3bf8e

  • SSDEEP

    3072:MyclpP1GAdv34Csbgl1OmU+c0vDkdFxxHNN:i1GAdv34W2j+rrgxHNN

Malware Config

Extracted

Family

redline

Botnet

2.22

C2

95.211.185.27:59230

Targets

    • Target

      ee30796aa4784093fdfe528e83fb78b9fe72bbd5ea72a0ee7b242081a454da65

    • Size

      299KB

    • MD5

      4eb4b9ae61baa9f7a042856a2418c8af

    • SHA1

      40f2c50adbd4d94864a9ca04f229388e359e9ca4

    • SHA256

      ee30796aa4784093fdfe528e83fb78b9fe72bbd5ea72a0ee7b242081a454da65

    • SHA512

      01dea732ce94a5fd68c6ef9350aa4a1fbb85bd8d3d72ebf43ebdda2e7054af7c40c43d84ba9c0bfaea7683edce4b014ee462d12744a80259793c2b5f0f5da02e

    • SSDEEP

      3072:2i86AdaeKZepQzAS3SZlyddfsvMv2Zu32cA4SZ3wnrZNPe61k8hf9xXv:F7Adj4kA6ywI2cAerZQ6199xX

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks