General

  • Target

    dd25905bdd3a29daf6515c3ce51155f08ab303b50a95196c0877c016f63a184d.exe

  • Size

    768KB

  • Sample

    241126-1a5pasxkcm

  • MD5

    37574421be2ebdf28616c62bfc29aa50

  • SHA1

    4c65300a68a19e2a9b58048517e5764fd6ed76fb

  • SHA256

    dd25905bdd3a29daf6515c3ce51155f08ab303b50a95196c0877c016f63a184d

  • SHA512

    f2a0c5e6288434e79f01df236f6554360dc43521bad726b222a0b242271c4fe4997f13c994ad663eb76283ca361105460ce086c9df488aefb6b1d09e53f16b41

  • SSDEEP

    12288:1paoy89TKFdcgviDi01Of+xLsdG2pjiTxUlJ8LEKShOMyMryAU9XdHTSczcBFkHF:1UzRb7W+hJ0r8yM9wdzSczcBFkHF

Malware Config

Extracted

Family

redline

Botnet

@Durak9876

C2

95.181.152.5:46927

Attributes
  • auth_value

    cdf3919a262c0d6ba99116b375d7551c

Targets

    • Target

      dd25905bdd3a29daf6515c3ce51155f08ab303b50a95196c0877c016f63a184d.exe

    • Size

      768KB

    • MD5

      37574421be2ebdf28616c62bfc29aa50

    • SHA1

      4c65300a68a19e2a9b58048517e5764fd6ed76fb

    • SHA256

      dd25905bdd3a29daf6515c3ce51155f08ab303b50a95196c0877c016f63a184d

    • SHA512

      f2a0c5e6288434e79f01df236f6554360dc43521bad726b222a0b242271c4fe4997f13c994ad663eb76283ca361105460ce086c9df488aefb6b1d09e53f16b41

    • SSDEEP

      12288:1paoy89TKFdcgviDi01Of+xLsdG2pjiTxUlJ8LEKShOMyMryAU9XdHTSczcBFkHF:1UzRb7W+hJ0r8yM9wdzSczcBFkHF

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks