General

  • Target

    ae3b1ab62a7f522dbd428fe52590b7f4abca6e355f40c92a531066adfd9c4ee7.exe

  • Size

    426KB

  • Sample

    241123-betedstnbz

  • MD5

    047192debce3c838003370e7108ac885

  • SHA1

    03487f4b72a51ac6eab8c40eb417bc9bcbdc49c6

  • SHA256

    ae3b1ab62a7f522dbd428fe52590b7f4abca6e355f40c92a531066adfd9c4ee7

  • SHA512

    d21d1b8efa91f23404033462d7d2b3c10569f1de603a1e37c72f962a372f0895332f31b8fae73ab8f530dba30fc35b409933ff463518975f301459bd3e1c2e59

  • SSDEEP

    12288:NOGTHCu1H/BPd+47EYzUSUZ+seswutyI9mmBa:NOsCcfBPHIYQhesw/t

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

37.228.129.48:29795

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      ae3b1ab62a7f522dbd428fe52590b7f4abca6e355f40c92a531066adfd9c4ee7.exe

    • Size

      426KB

    • MD5

      047192debce3c838003370e7108ac885

    • SHA1

      03487f4b72a51ac6eab8c40eb417bc9bcbdc49c6

    • SHA256

      ae3b1ab62a7f522dbd428fe52590b7f4abca6e355f40c92a531066adfd9c4ee7

    • SHA512

      d21d1b8efa91f23404033462d7d2b3c10569f1de603a1e37c72f962a372f0895332f31b8fae73ab8f530dba30fc35b409933ff463518975f301459bd3e1c2e59

    • SSDEEP

      12288:NOGTHCu1H/BPd+47EYzUSUZ+seswutyI9mmBa:NOsCcfBPHIYQhesw/t

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks