General

  • Target

    scheduledllama.exe

  • Size

    95KB

  • Sample

    241213-mm81laxnal

  • MD5

    46aa8f5fe3d5af96f0a970a8f4df625d

  • SHA1

    0b4395edb19d330ad6dc285767b4f5a4a7a16c05

  • SHA256

    b2a54962c45f5dbd7af447a5ab4cf8cea752f8c667d4dc504e1834da94ac4514

  • SHA512

    e6b1ded614f634e68b17a1ecd4f75538703f0b8603913b2abd30d0d98331f84c3f2b38b8cfe19615d7e5bfe645837bee8a4f604f54bb95ac8c98c830ab7fe47f

  • SSDEEP

    1536:9qs8XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2ytmulgS6pY:ragzWHY3+zi0ZbYe1g0ujyzduY

Malware Config

Extracted

Family

redline

Botnet

PO

C2

147.124.222.241:47056

Targets

    • Target

      scheduledllama.exe

    • Size

      95KB

    • MD5

      46aa8f5fe3d5af96f0a970a8f4df625d

    • SHA1

      0b4395edb19d330ad6dc285767b4f5a4a7a16c05

    • SHA256

      b2a54962c45f5dbd7af447a5ab4cf8cea752f8c667d4dc504e1834da94ac4514

    • SHA512

      e6b1ded614f634e68b17a1ecd4f75538703f0b8603913b2abd30d0d98331f84c3f2b38b8cfe19615d7e5bfe645837bee8a4f604f54bb95ac8c98c830ab7fe47f

    • SSDEEP

      1536:9qs8XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2ytmulgS6pY:ragzWHY3+zi0ZbYe1g0ujyzduY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks