General

  • Target

    b7536335a0cd380f8b01a8f4bec6734314a0fc3e275e2f4d031dcfe988d7d3ea

  • Size

    256KB

  • Sample

    241110-vwt7ss1hjc

  • MD5

    048b3419fbc44454cf100d6281f42007

  • SHA1

    be207c1184babb017d35cddd6b00c72d9ac34840

  • SHA256

    b7536335a0cd380f8b01a8f4bec6734314a0fc3e275e2f4d031dcfe988d7d3ea

  • SHA512

    f185f53c55fa485d745610dd20d07c96da46ae7a4bbf7f3a1e179d91e85b3da6e08135aed0c5eead513040e690580ec99ae559ec24c6066a0000265f16c75f49

  • SSDEEP

    6144:DGzaF0SWUvYex8ESWqxrE2N4jDWbNZc0Pt/ZwlBgJpqh:UaFxYe8Zr/NgDuNiot/ZGBT

Malware Config

Extracted

Family

redline

C2

185.215.113.29:8678

Targets

    • Target

      b7536335a0cd380f8b01a8f4bec6734314a0fc3e275e2f4d031dcfe988d7d3ea

    • Size

      256KB

    • MD5

      048b3419fbc44454cf100d6281f42007

    • SHA1

      be207c1184babb017d35cddd6b00c72d9ac34840

    • SHA256

      b7536335a0cd380f8b01a8f4bec6734314a0fc3e275e2f4d031dcfe988d7d3ea

    • SHA512

      f185f53c55fa485d745610dd20d07c96da46ae7a4bbf7f3a1e179d91e85b3da6e08135aed0c5eead513040e690580ec99ae559ec24c6066a0000265f16c75f49

    • SSDEEP

      6144:DGzaF0SWUvYex8ESWqxrE2N4jDWbNZc0Pt/ZwlBgJpqh:UaFxYe8Zr/NgDuNiot/ZGBT

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks