General

  • Target

    54e5cbee32e97ed81ef1268cb8149456d7761642fef5edf98c6187f053a7da5b

  • Size

    385KB

  • Sample

    241110-tmha7stlcj

  • MD5

    ee26d2a15362a0dd93bf33dee641c5d6

  • SHA1

    2468ca3a56012e3dfced11ba676ecbbaa786a65c

  • SHA256

    54e5cbee32e97ed81ef1268cb8149456d7761642fef5edf98c6187f053a7da5b

  • SHA512

    24f1143985ed81b3296979d63bfa8c8fec1751b7da93fa02d9d25209cad0acef50c3fe377d67fcfbb672514a8195ea98d2bbb7221d447df005c8bd1ffe3b005a

  • SSDEEP

    6144:WhZG537hB//zRKIeQGqiGnaLvkKNjViyaOE6RayHET2smTFqjKmWu:us7P1KIhnn0vkuJiyaOE6R02smTeY

Malware Config

Extracted

Family

redline

Botnet

usamoney

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      54e5cbee32e97ed81ef1268cb8149456d7761642fef5edf98c6187f053a7da5b

    • Size

      385KB

    • MD5

      ee26d2a15362a0dd93bf33dee641c5d6

    • SHA1

      2468ca3a56012e3dfced11ba676ecbbaa786a65c

    • SHA256

      54e5cbee32e97ed81ef1268cb8149456d7761642fef5edf98c6187f053a7da5b

    • SHA512

      24f1143985ed81b3296979d63bfa8c8fec1751b7da93fa02d9d25209cad0acef50c3fe377d67fcfbb672514a8195ea98d2bbb7221d447df005c8bd1ffe3b005a

    • SSDEEP

      6144:WhZG537hB//zRKIeQGqiGnaLvkKNjViyaOE6RayHET2smTFqjKmWu:us7P1KIhnn0vkuJiyaOE6R02smTeY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks