General

  • Target

    b625d7cccdf850051b757b22c73b11ef68b06bb513a33b0640098d98650d459c

  • Size

    332KB

  • Sample

    241111-edt63swjam

  • MD5

    1865bea8bbb6eae98aac4570b613a9bc

  • SHA1

    34391b8543407ec2d352b0d112f0b1358fade038

  • SHA256

    b625d7cccdf850051b757b22c73b11ef68b06bb513a33b0640098d98650d459c

  • SHA512

    ef25f5b40f47ca72cdbe34831e36c7cd56c3fb8289307f953eca0baa9f123c8559c851eaac10cfd41fb15308cb5a2a0925c13f144ecbff37604b932eeba38f25

  • SSDEEP

    6144:yoxeQWHeUfxB4fjBZZzy5omD1WH99YuR36z53PYNiOju3Tgg+o:ycc+MxB4Zzy5o/HbPJ6Ngg3Tgt

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

178.63.26.132:29795

Targets

    • Target

      b625d7cccdf850051b757b22c73b11ef68b06bb513a33b0640098d98650d459c

    • Size

      332KB

    • MD5

      1865bea8bbb6eae98aac4570b613a9bc

    • SHA1

      34391b8543407ec2d352b0d112f0b1358fade038

    • SHA256

      b625d7cccdf850051b757b22c73b11ef68b06bb513a33b0640098d98650d459c

    • SHA512

      ef25f5b40f47ca72cdbe34831e36c7cd56c3fb8289307f953eca0baa9f123c8559c851eaac10cfd41fb15308cb5a2a0925c13f144ecbff37604b932eeba38f25

    • SSDEEP

      6144:yoxeQWHeUfxB4fjBZZzy5omD1WH99YuR36z53PYNiOju3Tgg+o:ycc+MxB4Zzy5o/HbPJ6Ngg3Tgt

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks