General

  • Target

    2efe89c8eb22b237de3b4f7f5e63e8a54cbbd4b5d186904e65650c55f83a6613

  • Size

    101KB

  • Sample

    241110-zar8jatpbs

  • MD5

    204b6a11a298737dcce20fa3ef8a19bd

  • SHA1

    d94d1f7559aa3510c57cfc0be0fd5122d221f928

  • SHA256

    2efe89c8eb22b237de3b4f7f5e63e8a54cbbd4b5d186904e65650c55f83a6613

  • SHA512

    f84e8e2163e85fcacb4bc5e7ced491152a6e03a987b1336fdd34c048b26ad09216bb6f75cd5d3c4046f8b473d06e06eb11ed3c1e140f92081a9fe7a838175504

  • SSDEEP

    1536:Jo6aGNzChCaAOv4yU5ohzGaudwYgbue7vUuGNyAsd/Netx5RE6G6WAaoigb:JdxFCbN9ae3UuoyddoNWor

Malware Config

Extracted

Family

redline

Botnet

@chmoeblan1

C2

45.132.104.3:18717

Targets

    • Target

      2efe89c8eb22b237de3b4f7f5e63e8a54cbbd4b5d186904e65650c55f83a6613

    • Size

      101KB

    • MD5

      204b6a11a298737dcce20fa3ef8a19bd

    • SHA1

      d94d1f7559aa3510c57cfc0be0fd5122d221f928

    • SHA256

      2efe89c8eb22b237de3b4f7f5e63e8a54cbbd4b5d186904e65650c55f83a6613

    • SHA512

      f84e8e2163e85fcacb4bc5e7ced491152a6e03a987b1336fdd34c048b26ad09216bb6f75cd5d3c4046f8b473d06e06eb11ed3c1e140f92081a9fe7a838175504

    • SSDEEP

      1536:Jo6aGNzChCaAOv4yU5ohzGaudwYgbue7vUuGNyAsd/Netx5RE6G6WAaoigb:JdxFCbN9ae3UuoyddoNWor

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks