General

  • Target

    1f2da2d40d041ed3552ac7a33060ded8f2e2ac5c7e4530c5c5870fe2acf17600

  • Size

    412KB

  • Sample

    241111-kq693awgrr

  • MD5

    dfe17258e068ae03ac13995f60b876b4

  • SHA1

    4bdd76bca0054e62a44f8ee5c770b7d31b8c7b4f

  • SHA256

    1f2da2d40d041ed3552ac7a33060ded8f2e2ac5c7e4530c5c5870fe2acf17600

  • SHA512

    80c119b11f64045445b3720cbe076156c04f834fb50f7fd7660652826829e982b83c7f3a8e79bbc6ed44fd2e36ea2179e871cb56df4576ac51cd373efee5f55f

  • SSDEEP

    12288:Vb/JaYNkFaLebYTNFSP4Urr6F/xVFCPb7:5BaQV8YTNFzUKFC

Malware Config

Extracted

Family

redline

Botnet

money

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      1f2da2d40d041ed3552ac7a33060ded8f2e2ac5c7e4530c5c5870fe2acf17600

    • Size

      412KB

    • MD5

      dfe17258e068ae03ac13995f60b876b4

    • SHA1

      4bdd76bca0054e62a44f8ee5c770b7d31b8c7b4f

    • SHA256

      1f2da2d40d041ed3552ac7a33060ded8f2e2ac5c7e4530c5c5870fe2acf17600

    • SHA512

      80c119b11f64045445b3720cbe076156c04f834fb50f7fd7660652826829e982b83c7f3a8e79bbc6ed44fd2e36ea2179e871cb56df4576ac51cd373efee5f55f

    • SSDEEP

      12288:Vb/JaYNkFaLebYTNFSP4Urr6F/xVFCPb7:5BaQV8YTNFzUKFC

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks