General

  • Target

    f9fc5799e5b5b0f3017ca47a3e65d127cb6d68427084b932a5ffd89e3bdf4fd8

  • Size

    345KB

  • Sample

    241110-x9r1pstcjk

  • MD5

    5e7d9dc14ea2d8ab60b180ff1d70ed8e

  • SHA1

    7dc25f05d7090e63430a8656fda9717d2b8bc6c4

  • SHA256

    f9fc5799e5b5b0f3017ca47a3e65d127cb6d68427084b932a5ffd89e3bdf4fd8

  • SHA512

    ae7a752a2b9800863448a354a8f2e6d2e573ef3f0ff8f3e7038f686eb31dc74f0d3ee8e57e3c70b8531f8b1833959858bd04eb4c144cb47ed7e6fbd45831aad6

  • SSDEEP

    6144:naBR4zTKb0iW597fW+vM6SC9oVHwo8+J+AnG35im4+rzV:yR4zTw0iY7XvM6SceHH8+JvGg+HV

Malware Config

Extracted

Family

redline

Botnet

222

C2

85.235.82.212:54632

Targets

    • Target

      f9fc5799e5b5b0f3017ca47a3e65d127cb6d68427084b932a5ffd89e3bdf4fd8

    • Size

      345KB

    • MD5

      5e7d9dc14ea2d8ab60b180ff1d70ed8e

    • SHA1

      7dc25f05d7090e63430a8656fda9717d2b8bc6c4

    • SHA256

      f9fc5799e5b5b0f3017ca47a3e65d127cb6d68427084b932a5ffd89e3bdf4fd8

    • SHA512

      ae7a752a2b9800863448a354a8f2e6d2e573ef3f0ff8f3e7038f686eb31dc74f0d3ee8e57e3c70b8531f8b1833959858bd04eb4c144cb47ed7e6fbd45831aad6

    • SSDEEP

      6144:naBR4zTKb0iW597fW+vM6SC9oVHwo8+J+AnG35im4+rzV:yR4zTw0iY7XvM6SceHH8+JvGg+HV

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks