General

  • Target

    12d325c2093d5b17b5bd4dfc95247028b72998f1e6a7f4a7743b15edf652ac96

  • Size

    95KB

  • Sample

    241206-ypbzeszrhn

  • MD5

    ca1eeb1ed6c16dc5bd03b199b74917e3

  • SHA1

    646e48f5093fe53a4045386adc9bc7973df6b42a

  • SHA256

    12d325c2093d5b17b5bd4dfc95247028b72998f1e6a7f4a7743b15edf652ac96

  • SHA512

    69f443b73335ba801fbb3f9b1de28f77d66218c8cc565529f380786fb340af3db94f5cf4bafe7f76b3f9f517800fdac03d04dfc1e9e2ceff42efe31512ed35fe

  • SSDEEP

    1536:mqsa9qRhlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2DteulgS6p0:UqWnY3+zi0ZbYe1g0ujyzd/0

Malware Config

Extracted

Family

redline

Botnet

SSA

C2

216.122.187.249:55123

Targets

    • Target

      12d325c2093d5b17b5bd4dfc95247028b72998f1e6a7f4a7743b15edf652ac96

    • Size

      95KB

    • MD5

      ca1eeb1ed6c16dc5bd03b199b74917e3

    • SHA1

      646e48f5093fe53a4045386adc9bc7973df6b42a

    • SHA256

      12d325c2093d5b17b5bd4dfc95247028b72998f1e6a7f4a7743b15edf652ac96

    • SHA512

      69f443b73335ba801fbb3f9b1de28f77d66218c8cc565529f380786fb340af3db94f5cf4bafe7f76b3f9f517800fdac03d04dfc1e9e2ceff42efe31512ed35fe

    • SSDEEP

      1536:mqsa9qRhlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2DteulgS6p0:UqWnY3+zi0ZbYe1g0ujyzd/0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks