General

  • Target

    653d6ce634e48983023bd93e7e057f56eadee08a64c527c760478d1264eeeb72

  • Size

    409KB

  • Sample

    241105-c6fs2stcqn

  • MD5

    5c0538a967065c181d4ff0cf298f2da0

  • SHA1

    847be33b4c79bc30d7e39d154790b09842a1e95f

  • SHA256

    653d6ce634e48983023bd93e7e057f56eadee08a64c527c760478d1264eeeb72

  • SHA512

    ae6044e5135faa99bfff8c018dd1d77c87d2bc404fa057da19507e0b0a46306d9b06865ec923c5b5bcff106d898a4b923b66b775cf4ae41257b899b0f4858511

  • SSDEEP

    6144:+1bLJ/gz8eozixMSp91CUOmYxUsNkWf9NBxl8Mx+zvJA6ePsZC8I+ewoLw8nu:+ZxtzA9oUU1NxV7X8A+zvDkseP

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      653d6ce634e48983023bd93e7e057f56eadee08a64c527c760478d1264eeeb72

    • Size

      409KB

    • MD5

      5c0538a967065c181d4ff0cf298f2da0

    • SHA1

      847be33b4c79bc30d7e39d154790b09842a1e95f

    • SHA256

      653d6ce634e48983023bd93e7e057f56eadee08a64c527c760478d1264eeeb72

    • SHA512

      ae6044e5135faa99bfff8c018dd1d77c87d2bc404fa057da19507e0b0a46306d9b06865ec923c5b5bcff106d898a4b923b66b775cf4ae41257b899b0f4858511

    • SSDEEP

      6144:+1bLJ/gz8eozixMSp91CUOmYxUsNkWf9NBxl8Mx+zvJA6ePsZC8I+ewoLw8nu:+ZxtzA9oUU1NxV7X8A+zvDkseP

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks