General

  • Target

    download2-word-exe.zip

  • Size

    41KB

  • Sample

    241126-vwxypa1kds

  • MD5

    c734b70ce564f87896ffbc39e00087ab

  • SHA1

    403c99f1bed85af47bb77456dcef7fd4cd0d20d7

  • SHA256

    ffd0597973e8343aa79f3a624105b7c4ae7cd6f24bb28447ef7f5bc6589036dc

  • SHA512

    5baa90d732f0e300fd21653d6f1901002bb68704b866f8cc70e08bea22b080b956f5e16cb4d21dbe59c999862c73c06c9b012f9d0e148591afe01a1d7e25d4de

  • SSDEEP

    768:oH3Eg69wSVZqH+7enNyfmgbGX0Zszw7nhbfVq06Wjc4zFUm3y2YeKjU6dzx:o76++7eeGss2fkuNzmm39R6d9

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

24.152.39.79:63387

Targets

    • Target

      download2-word-exe

    • Size

      95KB

    • MD5

      9a5b81e5bb91e87a6e289dd7d2945603

    • SHA1

      0ce2f5aa6e306736d80752ef912f7d48c43f04ee

    • SHA256

      bf5b34425d47de5b5adb0fcb0b34e01daa36999a1c8d66d422831ede5475bf8a

    • SHA512

      914a2848c67f98d29e615817045a527edc8259107d67a6eff95848d10a7b1d421d15fed8094fddc1e12ebd611c695245cd6c070261b48d99c5ed269d1c5168b2

    • SSDEEP

      1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2V3tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdpY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks