General

  • Target

    Remote Administration Tool FREE.rar

  • Size

    9.2MB

  • Sample

    250408-xhrwmayms9

  • MD5

    4e3a80bc68a053ce6aac48b4109059e0

  • SHA1

    b4c643a3f8bd6f56e5bf96bccfb6fc6dd9b95e08

  • SHA256

    09cccb55d5f82c274fd52cbff09e0256a779c6f8cabc2c70be3637babd12ebb2

  • SHA512

    6282fe443e70d1831bfed758c68cae784189549798fd2ef7d04a8d863f65b6201cc4428ec430eb373c68dbb5bc216c60fc368071c34cec9ecda3d5894fb73ff2

  • SSDEEP

    196608:/y0h8nGMJl8J4BzaOgAhxYKP/OZevpoE9woAJ12AsZJiRAbftr47Ow:V+GMJphaliJC8p9eP/svf9WX

Malware Config

Extracted

Family

redline

Botnet

telegramone

C2

163.5.160.27:51523

Targets

    • Target

      Remote Administration Tool FREE.rar

    • Size

      9.2MB

    • MD5

      4e3a80bc68a053ce6aac48b4109059e0

    • SHA1

      b4c643a3f8bd6f56e5bf96bccfb6fc6dd9b95e08

    • SHA256

      09cccb55d5f82c274fd52cbff09e0256a779c6f8cabc2c70be3637babd12ebb2

    • SHA512

      6282fe443e70d1831bfed758c68cae784189549798fd2ef7d04a8d863f65b6201cc4428ec430eb373c68dbb5bc216c60fc368071c34cec9ecda3d5894fb73ff2

    • SSDEEP

      196608:/y0h8nGMJl8J4BzaOgAhxYKP/OZevpoE9woAJ12AsZJiRAbftr47Ow:V+GMJphaliJC8p9eP/svf9WX

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks