General

  • Target

    d5cbe8b58cafa0f5e17d4c65cbbece309a41151859503e931263e4273d388648

  • Size

    240KB

  • Sample

    241105-adjywszkbt

  • MD5

    a7db75ff7d70de12af69b177740a180f

  • SHA1

    f7a52994f69475064fef6e57f73724cf05a64da6

  • SHA256

    d5cbe8b58cafa0f5e17d4c65cbbece309a41151859503e931263e4273d388648

  • SHA512

    8af865b75ab4451d28ea557ec671b35aa418ba8a605da3b0f78bee42d8441bee34123f16821b8bb070923ad2a7f8c2826ef852dd34ff0018039ef246227bb4db

  • SSDEEP

    3072:TBPv940136Lbb6D7AYcryYDOjuMcPbJalTCp3/bDEITf+4P5E3ajaxzol0OHz:T1CgMz/ryYDOjuMSdak3TfT4ea+GOT

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      d5cbe8b58cafa0f5e17d4c65cbbece309a41151859503e931263e4273d388648

    • Size

      240KB

    • MD5

      a7db75ff7d70de12af69b177740a180f

    • SHA1

      f7a52994f69475064fef6e57f73724cf05a64da6

    • SHA256

      d5cbe8b58cafa0f5e17d4c65cbbece309a41151859503e931263e4273d388648

    • SHA512

      8af865b75ab4451d28ea557ec671b35aa418ba8a605da3b0f78bee42d8441bee34123f16821b8bb070923ad2a7f8c2826ef852dd34ff0018039ef246227bb4db

    • SSDEEP

      3072:TBPv940136Lbb6D7AYcryYDOjuMcPbJalTCp3/bDEITf+4P5E3ajaxzol0OHz:T1CgMz/ryYDOjuMSdak3TfT4ea+GOT

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks