General

  • Target

    2025-04-02_1c39fbf2759213f5739b82bb14ec09a2_amadey_black-basta_luca-stealer

  • Size

    1.7MB

  • Sample

    250402-myk3xayjx5

  • MD5

    1c39fbf2759213f5739b82bb14ec09a2

  • SHA1

    e27f318c1134f677467b190cf79e9cb8764f71b7

  • SHA256

    4f535b71bc8779e7dfe0ddfd5acd344e89d7a43664f557dbf445e5a68c500615

  • SHA512

    0be5a9949703d4588c1e054c6def04e094ca77987e6f09a484f4583c8eaa479e76feaa126990b5e69077ebdaf7e0889c333bbc311d178aac9442c497280d947f

  • SSDEEP

    12288:tePSfbSHesL+SLdAcxfWqpHhsFpL67n1nhp:te+SFLbAKRhsnMn1nD

Malware Config

Extracted

Family

redline

Botnet

@Lumexyy

C2

176.57.71.68:37814

Attributes
  • auth_value

    6e134fbe11e1fba7052c029b94245b55

Targets

    • Target

      2025-04-02_1c39fbf2759213f5739b82bb14ec09a2_amadey_black-basta_luca-stealer

    • Size

      1.7MB

    • MD5

      1c39fbf2759213f5739b82bb14ec09a2

    • SHA1

      e27f318c1134f677467b190cf79e9cb8764f71b7

    • SHA256

      4f535b71bc8779e7dfe0ddfd5acd344e89d7a43664f557dbf445e5a68c500615

    • SHA512

      0be5a9949703d4588c1e054c6def04e094ca77987e6f09a484f4583c8eaa479e76feaa126990b5e69077ebdaf7e0889c333bbc311d178aac9442c497280d947f

    • SSDEEP

      12288:tePSfbSHesL+SLdAcxfWqpHhsFpL67n1nhp:te+SFLbAKRhsnMn1nD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks