Overview

overview

10

Static

static

3

99be762e30...19.exe

windows7-x64

10

99be762e30...19.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4195c7ba738a6cb07a944819874b6ae8.zip

  • Size

    255KB

  • Sample

    240901-s5ykgavdrq

  • MD5

    fce6eae429c91be2ad589226b3b3385d

  • SHA1

    114bbcd97606776dee5553071127c94e07fb3408

  • SHA256

    82d8e65f6dcbf4babfdd5bb7e5ac7cc06365a13ec88b93bdb8bcfb6382ce07a8

  • SHA512

    1574b8de777d5556eb8192ccd7af810939efae76a85ea66d61bebba7f4b208f8456aaf5505734344ef4a878b5f638b531757c6afbbdaee254fa4f8827812096e

  • SSDEEP

    6144:yaFfIjIXx0kRJKZpAbD29qhcbG3JsbBC4n+pxBJoo6bJuR:yafXx00QZpI2xssk4CxBJsbu

Score
10/10
redlinesectopratudpdiscoveryinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      99be762e300ce54ae6afed2893d0906104a1765cca7bbbb2b9c20dcc99641819

    • Size

      417KB

    • MD5

      4195c7ba738a6cb07a944819874b6ae8

    • SHA1

      4c0941a81a7672639797c755bf9595701b40f9df

    • SHA256

      99be762e300ce54ae6afed2893d0906104a1765cca7bbbb2b9c20dcc99641819

    • SHA512

      dd9aaa975574853958039b23b1338d1d527f30ec927bb42b15739acc463172d2df5e7c8ebe277ac937aea5934eb05f6763e99dfe1d386ca8ba69d64f4b21be81

    • SSDEEP

      12288:aN3h2iDhFhws8sjd8wvQ3nDGdji94VWhiG9LC:aNx2+hF/8sB8X3N94VW

    Score
    10/10
    redlinesectopratudpdiscoveryinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks