General

  • Target

    a83a1018e4d36363b3be4d932c485767746f2ee9fd35750fc355679102cc31a2

  • Size

    364KB

  • Sample

    241104-xd6h8avhrp

  • MD5

    c770bdbaff82738b79eb5017763feddd

  • SHA1

    8b48a81b4dd85a0713fcc330350771d9da573885

  • SHA256

    a83a1018e4d36363b3be4d932c485767746f2ee9fd35750fc355679102cc31a2

  • SHA512

    c00cc911225c0273eb78436689653323fc0bdd943493016bd940701094df4844c262928a54c8261ba331bf27b243bae01e6911f824b0927b0a805584041192b8

  • SSDEEP

    6144:MN4yCCKwd39FeWbt1B78EXAKAonJnEMkDFKqX7tNfVXVHQLIiu8cfo0/pW:MSyCXwdrXZ1BPEoJKKwZGEX8cA0/M

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      a83a1018e4d36363b3be4d932c485767746f2ee9fd35750fc355679102cc31a2

    • Size

      364KB

    • MD5

      c770bdbaff82738b79eb5017763feddd

    • SHA1

      8b48a81b4dd85a0713fcc330350771d9da573885

    • SHA256

      a83a1018e4d36363b3be4d932c485767746f2ee9fd35750fc355679102cc31a2

    • SHA512

      c00cc911225c0273eb78436689653323fc0bdd943493016bd940701094df4844c262928a54c8261ba331bf27b243bae01e6911f824b0927b0a805584041192b8

    • SSDEEP

      6144:MN4yCCKwd39FeWbt1B78EXAKAonJnEMkDFKqX7tNfVXVHQLIiu8cfo0/pW:MSyCXwdrXZ1BPEoJKKwZGEX8cA0/M

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks