General

  • Target

    d9e66967d291d456ac234ca4cdce2103d94d3149a1955a2c0e7f9c2d62c1f4d0

  • Size

    253KB

  • Sample

    241104-3jfgwazgln

  • MD5

    ff2f1ae5fb91a5d1a037e5057637f450

  • SHA1

    bb892bf6b4e3b3b40df5ab577bb470f25c886829

  • SHA256

    d9e66967d291d456ac234ca4cdce2103d94d3149a1955a2c0e7f9c2d62c1f4d0

  • SHA512

    e4bf0429dc05df28794ec998ddafe3d2e99cfcc2e61b9e1bc6f33c6e33bb368aa06bacf9d32d98781ac86c0702bc7e6d9c095e75b9895ee31e0e4676a9664056

  • SSDEEP

    3072:qrRGH28IVOPHHVNQRXXBAKMKDfe9wFP2vxTVt0+y7Eqs59YFr36LF75/xnCkrD4:qhncNQRXeUi9wFupZt0l7Eqrk8g

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      d9e66967d291d456ac234ca4cdce2103d94d3149a1955a2c0e7f9c2d62c1f4d0

    • Size

      253KB

    • MD5

      ff2f1ae5fb91a5d1a037e5057637f450

    • SHA1

      bb892bf6b4e3b3b40df5ab577bb470f25c886829

    • SHA256

      d9e66967d291d456ac234ca4cdce2103d94d3149a1955a2c0e7f9c2d62c1f4d0

    • SHA512

      e4bf0429dc05df28794ec998ddafe3d2e99cfcc2e61b9e1bc6f33c6e33bb368aa06bacf9d32d98781ac86c0702bc7e6d9c095e75b9895ee31e0e4676a9664056

    • SSDEEP

      3072:qrRGH28IVOPHHVNQRXXBAKMKDfe9wFP2vxTVt0+y7Eqs59YFr36LF75/xnCkrD4:qhncNQRXeUi9wFupZt0l7Eqrk8g

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks