General

  • Target

    7185f477cad6950aa5fb2fb0d4153cddab826c591fe93a855448d860f02dc3a6.exe

  • Size

    432KB

  • Sample

    241122-xx8gxssnhp

  • MD5

    042de468ea1dc96a8f20d2b98a1e3fef

  • SHA1

    8e828b35586b092cd1a1ae22ce6bfcbf30494a27

  • SHA256

    7185f477cad6950aa5fb2fb0d4153cddab826c591fe93a855448d860f02dc3a6

  • SHA512

    b2635c9b37562ad2d49986bc321335f9657357e25667d52401cc602b3ed0e7ea69fb1be3d3de12cfce8a4efcbf025a1665d88d00063aba726ab2c84818e0c8e6

  • SSDEEP

    12288:mUEg0pPvwCCCNUZDBL+MlU43opBzcWzuuZVY6/:mdvpnwJXBaMx3opBVuA

Malware Config

Extracted

Family

redline

Botnet

she

C2

135.181.129.119:4805

Attributes
  • auth_value

    b69102cdbd4afe2d3159f88fb6dac731

Targets

    • Target

      7185f477cad6950aa5fb2fb0d4153cddab826c591fe93a855448d860f02dc3a6.exe

    • Size

      432KB

    • MD5

      042de468ea1dc96a8f20d2b98a1e3fef

    • SHA1

      8e828b35586b092cd1a1ae22ce6bfcbf30494a27

    • SHA256

      7185f477cad6950aa5fb2fb0d4153cddab826c591fe93a855448d860f02dc3a6

    • SHA512

      b2635c9b37562ad2d49986bc321335f9657357e25667d52401cc602b3ed0e7ea69fb1be3d3de12cfce8a4efcbf025a1665d88d00063aba726ab2c84818e0c8e6

    • SSDEEP

      12288:mUEg0pPvwCCCNUZDBL+MlU43opBzcWzuuZVY6/:mdvpnwJXBaMx3opBVuA

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks