General

  • Target

    d5c7732a2ec448ae7073be0699960352e2da29e4673c2f6b3132458255b11736

  • Size

    79KB

  • Sample

    241110-y2wvcstmdx

  • MD5

    b7dd75599145368f157214328025aef6

  • SHA1

    e9fad8b94b628ebaafa15786706fe11e15a14f21

  • SHA256

    d5c7732a2ec448ae7073be0699960352e2da29e4673c2f6b3132458255b11736

  • SHA512

    879793fa60fa4d9324d709b606354af61a17a46d21fbf84610b5c999b09557a45e3695e1ffa203e58ea7d8c1d0fb4e6b0ab0ad81dead9ed61f7749459d48bb7d

  • SSDEEP

    1536:uIEq/BQym8Wwv3XySMecTfzJZ8pWDWArvI25SGrEN1BM7Co9ynhACdOoRDeqFz:u0c8WwvySMeaJZLDJrA7NN1auo9g/JDL

Malware Config

Extracted

Family

redline

Botnet

BUILD7

C2

116.203.36.31:48090

Targets

    • Target

      4affde0906145b59b617833571ec9ee44d87eb82c4f159a6ead5fd0a49fdc5db.exe

    • Size

      270KB

    • MD5

      6c3123e59b49a835cdaae190cf784f8f

    • SHA1

      29a3c34c1c15ee6fb2a9c00b537a7686525a97c1

    • SHA256

      4affde0906145b59b617833571ec9ee44d87eb82c4f159a6ead5fd0a49fdc5db

    • SHA512

      decd71c69467bcc98d60324cf38de37313bcba9b1e353b9323cc713b095f0631b8e21d07781767b91408de360d5265527fc8b8d575e033dc1d4bb16bb61e2ea3

    • SSDEEP

      3072:WLN9P4873tmPp4Zty9m21yAHNyndY3PRg6Ae/TXs:v8JPD2Y+yW3PRgcrX

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks