General

  • Target

    b0a7676654c3125cf020a34bd3e5ed6c5dd93138a84b92560243fab1a80c66c6.exe

  • Size

    757KB

  • Sample

    241120-zddjjsxmdr

  • MD5

    da0f1d721676a79becdbc2087345b836

  • SHA1

    90e1c797798c7817f4a675257cba3cf2cc65e417

  • SHA256

    b0a7676654c3125cf020a34bd3e5ed6c5dd93138a84b92560243fab1a80c66c6

  • SHA512

    65317f6fcff11d423938a363b090dd156f0c52c419f1d103eea9b2565f651d00b0835d449627b8c598bde5b2a5427ec2dfc4fb62637e41b026a64380c23a9f46

  • SSDEEP

    12288:0nvTV/+mrJw9n1x2RiwKBG54XDPRkUvp351vgOs30IaxQmTlQeHISZM3J:mJ/juXkSNPrgJEVWmK53J

Malware Config

Extracted

Family

redline

Botnet

@kla1z

C2

92.119.113.189:21746

Attributes
  • auth_value

    de713911efa818890ac36085c9a0fc58

Targets

    • Target

      b0a7676654c3125cf020a34bd3e5ed6c5dd93138a84b92560243fab1a80c66c6.exe

    • Size

      757KB

    • MD5

      da0f1d721676a79becdbc2087345b836

    • SHA1

      90e1c797798c7817f4a675257cba3cf2cc65e417

    • SHA256

      b0a7676654c3125cf020a34bd3e5ed6c5dd93138a84b92560243fab1a80c66c6

    • SHA512

      65317f6fcff11d423938a363b090dd156f0c52c419f1d103eea9b2565f651d00b0835d449627b8c598bde5b2a5427ec2dfc4fb62637e41b026a64380c23a9f46

    • SSDEEP

      12288:0nvTV/+mrJw9n1x2RiwKBG54XDPRkUvp351vgOs30IaxQmTlQeHISZM3J:mJ/juXkSNPrgJEVWmK53J

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks