General

  • Target

    b68e44d9bb08d1ff2819fd56b0a8a354a86aa70bae855be4c778e239b718a5d6

  • Size

    319KB

  • Sample

    241105-hp74vswgrd

  • MD5

    b8b88cd373614cbc482087cbc233f749

  • SHA1

    a206dc3ef4d88807f1f49db2e1e5e03d52deb8b8

  • SHA256

    b68e44d9bb08d1ff2819fd56b0a8a354a86aa70bae855be4c778e239b718a5d6

  • SHA512

    15956ff2bbcd2dc792c551e1bcea33c067d7a20ad9284968bede6641939ba04a31901f66ad33cee8ab89de66eabae3b95814d4f5fd182a82be689baec28fdf74

  • SSDEEP

    6144:Cm/rGJOgNA+CDdgZPceOyvG+GFLX7BxATdMzBwjtw:d/rGJPA+CDdgZPcfyvGLFDDAJ6Bai

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      b68e44d9bb08d1ff2819fd56b0a8a354a86aa70bae855be4c778e239b718a5d6

    • Size

      319KB

    • MD5

      b8b88cd373614cbc482087cbc233f749

    • SHA1

      a206dc3ef4d88807f1f49db2e1e5e03d52deb8b8

    • SHA256

      b68e44d9bb08d1ff2819fd56b0a8a354a86aa70bae855be4c778e239b718a5d6

    • SHA512

      15956ff2bbcd2dc792c551e1bcea33c067d7a20ad9284968bede6641939ba04a31901f66ad33cee8ab89de66eabae3b95814d4f5fd182a82be689baec28fdf74

    • SSDEEP

      6144:Cm/rGJOgNA+CDdgZPceOyvG+GFLX7BxATdMzBwjtw:d/rGJPA+CDdgZPcfyvGLFDDAJ6Bai

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks