General

  • Target

    03f99a74168f3e5590b2e8fd76cbf77e0afb6f2e1a3e3bc41bd0b2a84061b212

  • Size

    240KB

  • Sample

    241104-rbc61a1apb

  • MD5

    bccb5d1cc976656cb2e84ab94609d227

  • SHA1

    abfaa2a279ae83bbabf61874ea904109e6a70f54

  • SHA256

    03f99a74168f3e5590b2e8fd76cbf77e0afb6f2e1a3e3bc41bd0b2a84061b212

  • SHA512

    aafd965b1e8c2ccfbf1a769ffaf4903802332bbed68146acc128ce41063a796deb3810e7fd1f99f7f50e90c23a16d78fdb67e829c43b293396e1ee41db6d5990

  • SSDEEP

    3072:DBPv92PHCIdbYSKm4/0Pc8X9Tia2Qm5dangUfEynvhtEtXJBzSutG0385/3iNKP1:D1YHYS9K0PEaMKNf1nptAXfzaiNSYBO

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      03f99a74168f3e5590b2e8fd76cbf77e0afb6f2e1a3e3bc41bd0b2a84061b212

    • Size

      240KB

    • MD5

      bccb5d1cc976656cb2e84ab94609d227

    • SHA1

      abfaa2a279ae83bbabf61874ea904109e6a70f54

    • SHA256

      03f99a74168f3e5590b2e8fd76cbf77e0afb6f2e1a3e3bc41bd0b2a84061b212

    • SHA512

      aafd965b1e8c2ccfbf1a769ffaf4903802332bbed68146acc128ce41063a796deb3810e7fd1f99f7f50e90c23a16d78fdb67e829c43b293396e1ee41db6d5990

    • SSDEEP

      3072:DBPv92PHCIdbYSKm4/0Pc8X9Tia2Qm5dangUfEynvhtEtXJBzSutG0385/3iNKP1:D1YHYS9K0PEaMKNf1nptAXfzaiNSYBO

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks