General

  • Target

    a3e1b61309fabb87ede7c168c49f8de5

  • Size

    39KB

  • Sample

    241111-hlnaaatqgw

  • MD5

    a3e1b61309fabb87ede7c168c49f8de5

  • SHA1

    47e73fd4f69880c905499f1620111ffd6fc3051d

  • SHA256

    66893148b0d748534dc339b1d78ba769da59c03f825e731c996d5d410ce41247

  • SHA512

    57d4a7ddb5b06da5270f05898e22fa715ccf247fb6de2874c14da164514451b0cbe0d549cc7b84f971ef523130704ded915fe9c3d19e54bf61891ff269d98761

  • SSDEEP

    768:tsfGR6aicvrOuLo0Q+DAFZhvTHLqd2fPf0Sx+2bs2QZ/vFsJnJuy3q+xEmvXK7:tNF6m7JDErpfPMvyQZXFs113q+xr+

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

2.tcp.eu.ngrok.io:10642

Targets

    • Target

      Netflix CheckerV12.9.exe

    • Size

      95KB

    • MD5

      42fe72738e1370f5bbaeb3db4f876355

    • SHA1

      6f6f1e41876a3173784b2a86963d3edb5a3759bc

    • SHA256

      be21f545f9fe4431d9a3c1369dba40ec4cd395106caef6c51c7ce04e6f44419d

    • SHA512

      24c4198b87051c08fbf91affa4a227ce9ad3a854a271c35b414569cf5a44c03f06c7ed172fc23a60d28e7096641c6b866167405961c91d5cd3d4b117723b2766

    • SSDEEP

      1536:Fqsgaq+A/lbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2J3teulgS6pQl:DfZeYP+zi0ZbYe1g0ujyzdxQ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks