General

  • Target

    ca5394e3361e15d3c58b1a340263805bc15902426c2709134b26fa20987a2707

  • Size

    414KB

  • Sample

    241111-kl2h1szngn

  • MD5

    2e1f6de2fcbaca527d1cc99f6b932fdd

  • SHA1

    b6a5e9c2d140b82ab16e426ddbce948dc9f36810

  • SHA256

    ca5394e3361e15d3c58b1a340263805bc15902426c2709134b26fa20987a2707

  • SHA512

    d5e8e3897fd0cc21223567f8ab59b41c5245a2a6ecbb4af7eff0bc0b93f1cb47692173a0df4376f5f3b578ead3cb715415756c702f79ed526b5cc733dcf7a3c4

  • SSDEEP

    6144:GAD5XoDUJcRzmm1uZ9th34w2BMcRYuv6KxzOQUaKq2fLoKo5WRr2JVeK:H5g+DzwMcRYOxxzOfNq2fLuWRr2H

Malware Config

Extracted

Family

redline

Botnet

money

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      ca5394e3361e15d3c58b1a340263805bc15902426c2709134b26fa20987a2707

    • Size

      414KB

    • MD5

      2e1f6de2fcbaca527d1cc99f6b932fdd

    • SHA1

      b6a5e9c2d140b82ab16e426ddbce948dc9f36810

    • SHA256

      ca5394e3361e15d3c58b1a340263805bc15902426c2709134b26fa20987a2707

    • SHA512

      d5e8e3897fd0cc21223567f8ab59b41c5245a2a6ecbb4af7eff0bc0b93f1cb47692173a0df4376f5f3b578ead3cb715415756c702f79ed526b5cc733dcf7a3c4

    • SSDEEP

      6144:GAD5XoDUJcRzmm1uZ9th34w2BMcRYuv6KxzOQUaKq2fLoKo5WRr2JVeK:H5g+DzwMcRYOxxzOfNq2fLuWRr2H

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks