General

  • Target

    699bbabab86bbc170ff41a3de1e4a745c3720a2907afcdcafe8fdcca36bb31b5.exe

  • Size

    386KB

  • Sample

    241122-n775gazpay

  • MD5

    310b7ad1cf80f8afb4cec9724ca6d592

  • SHA1

    bef744c3ff7bfe969e6b8ffb9bece7f0deca2dfd

  • SHA256

    699bbabab86bbc170ff41a3de1e4a745c3720a2907afcdcafe8fdcca36bb31b5

  • SHA512

    36e61725835cca9c64ac10ef8753d9c3fcc0d383de9122c99d52a9f509b13a61adde48ee1071d9984c6e0dedc6c3141227c30f6261bb26469b0cde5cdf2e35f2

  • SSDEEP

    12288:/XHEsGM4eM5KeqopU0i2pMOIDQDg56PvqWxNpIYHi:PH74hC/0DLVU8PvHA

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

188.68.201.6:10085

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      699bbabab86bbc170ff41a3de1e4a745c3720a2907afcdcafe8fdcca36bb31b5.exe

    • Size

      386KB

    • MD5

      310b7ad1cf80f8afb4cec9724ca6d592

    • SHA1

      bef744c3ff7bfe969e6b8ffb9bece7f0deca2dfd

    • SHA256

      699bbabab86bbc170ff41a3de1e4a745c3720a2907afcdcafe8fdcca36bb31b5

    • SHA512

      36e61725835cca9c64ac10ef8753d9c3fcc0d383de9122c99d52a9f509b13a61adde48ee1071d9984c6e0dedc6c3141227c30f6261bb26469b0cde5cdf2e35f2

    • SSDEEP

      12288:/XHEsGM4eM5KeqopU0i2pMOIDQDg56PvqWxNpIYHi:PH74hC/0DLVU8PvHA

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks