General

  • Target

    98daec0d5f3f6e9d377f4bb09b4cd22248a820fbf729c51fa7694d8c09bc70de

  • Size

    409KB

  • Sample

    241105-gm6mkswhkp

  • MD5

    7111286f0e8776f3fb909cbe80b8b537

  • SHA1

    acfdcb9363f3f3614c1870a6990acc0a66a14f67

  • SHA256

    98daec0d5f3f6e9d377f4bb09b4cd22248a820fbf729c51fa7694d8c09bc70de

  • SHA512

    02b36f5cf241449dd6d50a30db407c8dcddab28c95bf7b9c5de2cb9a3c9d689fdcf4d30900baa6090380f3458cac97782d8bd6333e76370de90970075f511799

  • SSDEEP

    12288:GlCPw0t8WuFhOnUqxNraB48e72ahvTWT9:GAIY8WuFhTW8i2ahE

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      98daec0d5f3f6e9d377f4bb09b4cd22248a820fbf729c51fa7694d8c09bc70de

    • Size

      409KB

    • MD5

      7111286f0e8776f3fb909cbe80b8b537

    • SHA1

      acfdcb9363f3f3614c1870a6990acc0a66a14f67

    • SHA256

      98daec0d5f3f6e9d377f4bb09b4cd22248a820fbf729c51fa7694d8c09bc70de

    • SHA512

      02b36f5cf241449dd6d50a30db407c8dcddab28c95bf7b9c5de2cb9a3c9d689fdcf4d30900baa6090380f3458cac97782d8bd6333e76370de90970075f511799

    • SSDEEP

      12288:GlCPw0t8WuFhOnUqxNraB48e72ahvTWT9:GAIY8WuFhTW8i2ahE

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks