General

  • Target

    b2edaf50d1a6a181e7eba081f6b37271ab0ce8db7b863c9966df6e2e9c13d5b0

  • Size

    287KB

  • Sample

    241110-w63glavrfn

  • MD5

    f51044584b3032e5672a8d5e528eaf1f

  • SHA1

    994dcce7660022192c9d590275899b87a4dc354a

  • SHA256

    b2edaf50d1a6a181e7eba081f6b37271ab0ce8db7b863c9966df6e2e9c13d5b0

  • SHA512

    f44976c80249a5d502124f3c6961e417250b22ed8aca053aca85f0bc145c7e060508fee033bdd751adc7311c04d9bcd364276c9598ff6c2ce6c0cc6bd87b0902

  • SSDEEP

    3072:LfB+kRk9IuV/HMa7Tow//qrw0TplyihhshN8Bu0RAIiDXqYXt5n2OQsWvg5TOHei:EkRkzHM4/Crlq2mhNQu0CT7AOOfkr

Malware Config

Extracted

Family

redline

C2

185.215.113.29:8678

Targets

    • Target

      b2edaf50d1a6a181e7eba081f6b37271ab0ce8db7b863c9966df6e2e9c13d5b0

    • Size

      287KB

    • MD5

      f51044584b3032e5672a8d5e528eaf1f

    • SHA1

      994dcce7660022192c9d590275899b87a4dc354a

    • SHA256

      b2edaf50d1a6a181e7eba081f6b37271ab0ce8db7b863c9966df6e2e9c13d5b0

    • SHA512

      f44976c80249a5d502124f3c6961e417250b22ed8aca053aca85f0bc145c7e060508fee033bdd751adc7311c04d9bcd364276c9598ff6c2ce6c0cc6bd87b0902

    • SSDEEP

      3072:LfB+kRk9IuV/HMa7Tow//qrw0TplyihhshN8Bu0RAIiDXqYXt5n2OQsWvg5TOHei:EkRkzHM4/Crlq2mhNQu0CT7AOOfkr

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks