General

  • Target

    6dcc6fd68850374cd1858226121b145f27f2ca56bc7e829239d576dad7cde056.exe

  • Size

    366KB

  • Sample

    241121-alrzgawemh

  • MD5

    9c1298ac1731d7721ed49b71c0fa9e1a

  • SHA1

    3d50b68ddd39870e1d66e154729f9273f70ac79a

  • SHA256

    6dcc6fd68850374cd1858226121b145f27f2ca56bc7e829239d576dad7cde056

  • SHA512

    1495b51625be1084ec25136c41fab6bcb1de6b5c682000d382d71166f306ab24bada1a54634897d24b290eeefaf8a79bff47982dd5a216d6f3771b951ea88447

  • SSDEEP

    6144:kvu6OkwK8F/mNVH7ZjlvfdvB3IG3TmNZgiU/FfgrjBLhqQpktXym:QxOeDNvRnU97giU/FfyBLhqsuym

Malware Config

Extracted

Family

redline

Botnet

sewPalp

C2

185.215.113.29:24645

Attributes
  • auth_value

    41d3df6d093b1e36993abf16af0d6f2d

Targets

    • Target

      6dcc6fd68850374cd1858226121b145f27f2ca56bc7e829239d576dad7cde056.exe

    • Size

      366KB

    • MD5

      9c1298ac1731d7721ed49b71c0fa9e1a

    • SHA1

      3d50b68ddd39870e1d66e154729f9273f70ac79a

    • SHA256

      6dcc6fd68850374cd1858226121b145f27f2ca56bc7e829239d576dad7cde056

    • SHA512

      1495b51625be1084ec25136c41fab6bcb1de6b5c682000d382d71166f306ab24bada1a54634897d24b290eeefaf8a79bff47982dd5a216d6f3771b951ea88447

    • SSDEEP

      6144:kvu6OkwK8F/mNVH7ZjlvfdvB3IG3TmNZgiU/FfgrjBLhqQpktXym:QxOeDNvRnU97giU/FfyBLhqsuym

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks