General

  • Target

    65c582f02ebae6f8589253a7c87d5a3e16837c520e1fb38069d4cd8499c97463

  • Size

    243KB

  • Sample

    241105-epzwpstley

  • MD5

    1c9d6a71bb239923c0eb9a98110a8a8d

  • SHA1

    a350b1da7f7ee4273c8e5f96058aaf174885ea64

  • SHA256

    65c582f02ebae6f8589253a7c87d5a3e16837c520e1fb38069d4cd8499c97463

  • SHA512

    224327574bebc884350858e71be084c61f4bee50275ae294615e003f55832fefa0aea48b3c12ee9f10c90624a8cc00c45036c7588ff499685eddcb5dfb04a787

  • SSDEEP

    3072:J7ZfniI3AxjVUPg+0hGbztjMWu+l4GpyXdjH7ZH8nxhKkKhn6lNbEnKx5pe9sTlj:JZVgRvh8jT4BXV7Zcnxhqh4l0v9sTl

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      65c582f02ebae6f8589253a7c87d5a3e16837c520e1fb38069d4cd8499c97463

    • Size

      243KB

    • MD5

      1c9d6a71bb239923c0eb9a98110a8a8d

    • SHA1

      a350b1da7f7ee4273c8e5f96058aaf174885ea64

    • SHA256

      65c582f02ebae6f8589253a7c87d5a3e16837c520e1fb38069d4cd8499c97463

    • SHA512

      224327574bebc884350858e71be084c61f4bee50275ae294615e003f55832fefa0aea48b3c12ee9f10c90624a8cc00c45036c7588ff499685eddcb5dfb04a787

    • SSDEEP

      3072:J7ZfniI3AxjVUPg+0hGbztjMWu+l4GpyXdjH7ZH8nxhKkKhn6lNbEnKx5pe9sTlj:JZVgRvh8jT4BXV7Zcnxhqh4l0v9sTl

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks