General

  • Target

    2ce810ae52b5a20c2ce364b43b653c5fcbe53a6cfd4e7f35cfe35620ccf9eacd.exe

  • Size

    364KB

  • Sample

    241123-y1yybs1jgk

  • MD5

    8fa85db51d2cb32258cc27a7ab9e234b

  • SHA1

    8b7bca6cfe6f5ba3dd4a625a283ee255eb5bda8d

  • SHA256

    2ce810ae52b5a20c2ce364b43b653c5fcbe53a6cfd4e7f35cfe35620ccf9eacd

  • SHA512

    7cf39d26cb8c08f561e74470cf5daa222aa522f523e5e200d57cc091b8b800f968ba552367aafc5942b27ed80e525814b4f0f5b7fb4cff13d631f354dd78014f

  • SSDEEP

    6144:3tlntEO/vU+2W9KDSfmUGFS28AEWwbVn9qVCJlvqxxtKuIADG8elz:3jntEO/8ngfmUGFO5h9qeR0KuxD4

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

188.68.201.6:10085

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      2ce810ae52b5a20c2ce364b43b653c5fcbe53a6cfd4e7f35cfe35620ccf9eacd.exe

    • Size

      364KB

    • MD5

      8fa85db51d2cb32258cc27a7ab9e234b

    • SHA1

      8b7bca6cfe6f5ba3dd4a625a283ee255eb5bda8d

    • SHA256

      2ce810ae52b5a20c2ce364b43b653c5fcbe53a6cfd4e7f35cfe35620ccf9eacd

    • SHA512

      7cf39d26cb8c08f561e74470cf5daa222aa522f523e5e200d57cc091b8b800f968ba552367aafc5942b27ed80e525814b4f0f5b7fb4cff13d631f354dd78014f

    • SSDEEP

      6144:3tlntEO/vU+2W9KDSfmUGFS28AEWwbVn9qVCJlvqxxtKuIADG8elz:3jntEO/8ngfmUGFO5h9qeR0KuxD4

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks