General

  • Target

    I5GV8_269dbdd699b875dd88816aa69b6328643e1fb2631db59c822a8412bdb463b028.exe

  • Size

    369KB

  • Sample

    241121-vzbjvstpfz

  • MD5

    bb4bc27533717f9c20faae9d057d97ab

  • SHA1

    e7b5972a9902865f85942791fd89c91313902d89

  • SHA256

    269dbdd699b875dd88816aa69b6328643e1fb2631db59c822a8412bdb463b028

  • SHA512

    6b50ca0768c5e8796b69f625250a43f3ae0201263aa978674b3a28b0c9c1ecdbf1fb5f40f3a7295f832dff984d741b162fbed8a2b0b503b8a57a320d35da6fa6

  • SSDEEP

    6144:o9CPkEhEEW4IrZ/NgWrd5CvY//GjG8KYX1ihI2:oUGYqNgm55GjG8KYX/2

Malware Config

Extracted

Family

redline

Botnet

sewPalp

C2

185.215.113.29:24645

Attributes
  • auth_value

    41d3df6d093b1e36993abf16af0d6f2d

Targets

    • Target

      I5GV8_269dbdd699b875dd88816aa69b6328643e1fb2631db59c822a8412bdb463b028.exe

    • Size

      369KB

    • MD5

      bb4bc27533717f9c20faae9d057d97ab

    • SHA1

      e7b5972a9902865f85942791fd89c91313902d89

    • SHA256

      269dbdd699b875dd88816aa69b6328643e1fb2631db59c822a8412bdb463b028

    • SHA512

      6b50ca0768c5e8796b69f625250a43f3ae0201263aa978674b3a28b0c9c1ecdbf1fb5f40f3a7295f832dff984d741b162fbed8a2b0b503b8a57a320d35da6fa6

    • SSDEEP

      6144:o9CPkEhEEW4IrZ/NgWrd5CvY//GjG8KYX1ihI2:oUGYqNgm55GjG8KYX/2

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks