General

  • Target

    2de33c4a812d237e9dc8c5e883ce84b877339a6be043e5b333ef0d618c117555

  • Size

    364KB

  • Sample

    241111-jcfphsypgr

  • MD5

    f14ec4f3e65383c168285af92ca31b5e

  • SHA1

    1bcff9b7bf9794b0db88194ee8a613ac6282ad32

  • SHA256

    2de33c4a812d237e9dc8c5e883ce84b877339a6be043e5b333ef0d618c117555

  • SHA512

    2c2674912a0e1699370ec17ecec6acba4c4bff064a6a2692c39271c5d5c092dd630dcbdf15f2b952e2f93aeccc793d32242c90508e177b191d24843359d5c9e1

  • SSDEEP

    6144:LLjjIgHP8EVLuH0YTFb09x40nGkM1BHNROXqfz/+uvqX7tNfVXVHQLIiu8cfo0/M:LLYgHP8Wu0YRb0+kM1BHrkyzvwZGEX8H

Malware Config

Extracted

Family

redline

Botnet

netlyvpn evadav

C2

94.103.9.181:25749

Attributes
  • auth_value

    2f7acec700c0507cc87a24aafe1c92fb

Targets

    • Target

      2de33c4a812d237e9dc8c5e883ce84b877339a6be043e5b333ef0d618c117555

    • Size

      364KB

    • MD5

      f14ec4f3e65383c168285af92ca31b5e

    • SHA1

      1bcff9b7bf9794b0db88194ee8a613ac6282ad32

    • SHA256

      2de33c4a812d237e9dc8c5e883ce84b877339a6be043e5b333ef0d618c117555

    • SHA512

      2c2674912a0e1699370ec17ecec6acba4c4bff064a6a2692c39271c5d5c092dd630dcbdf15f2b952e2f93aeccc793d32242c90508e177b191d24843359d5c9e1

    • SSDEEP

      6144:LLjjIgHP8EVLuH0YTFb09x40nGkM1BHNROXqfz/+uvqX7tNfVXVHQLIiu8cfo0/M:LLYgHP8Wu0YRb0+kM1BHrkyzvwZGEX8H

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks