General

  • Target

    ece536115218ac87d53dbbd1d993cb62d0ddb6bab5fdd3e1a95d6b818ade90e1

  • Size

    256KB

  • Sample

    241105-enppcatlbw

  • MD5

    1b7ab8d85b30968592fb0f7a5987d017

  • SHA1

    74f966cf46ac6992bcbfc126ba4219f457850946

  • SHA256

    ece536115218ac87d53dbbd1d993cb62d0ddb6bab5fdd3e1a95d6b818ade90e1

  • SHA512

    966745a534cad311386791187a66ca028749b1190c143bf6156fa30d668b9efc25c816673a0f78ba7713a36ae15146ce84df12fa4d9d6b05dee5a283e88eedc9

  • SSDEEP

    3072:GzXq8tLsFXVJXl8BIV9sUqtcCJP4lDRWAc3RKtYZGFl77+w7U7HHNAk5baQJztnp:GzaFlJXiBIr4Om+RWAaAYZGf+aULnae

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      ece536115218ac87d53dbbd1d993cb62d0ddb6bab5fdd3e1a95d6b818ade90e1

    • Size

      256KB

    • MD5

      1b7ab8d85b30968592fb0f7a5987d017

    • SHA1

      74f966cf46ac6992bcbfc126ba4219f457850946

    • SHA256

      ece536115218ac87d53dbbd1d993cb62d0ddb6bab5fdd3e1a95d6b818ade90e1

    • SHA512

      966745a534cad311386791187a66ca028749b1190c143bf6156fa30d668b9efc25c816673a0f78ba7713a36ae15146ce84df12fa4d9d6b05dee5a283e88eedc9

    • SSDEEP

      3072:GzXq8tLsFXVJXl8BIV9sUqtcCJP4lDRWAc3RKtYZGFl77+w7U7HHNAk5baQJztnp:GzaFlJXiBIr4Om+RWAaAYZGf+aULnae

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks