General

  • Target

    47837aca56584222061e2e76d03903c5cadb21ef8ec9c431c7e3bb4fb21c19fd

  • Size

    409KB

  • Sample

    241105-hxbqmaxfkm

  • MD5

    1044d2c396d4592f7726f7a6ac5e4e56

  • SHA1

    54c33a991f9ec4448352507a4585a7f951e4f205

  • SHA256

    47837aca56584222061e2e76d03903c5cadb21ef8ec9c431c7e3bb4fb21c19fd

  • SHA512

    09c16fa592c884a1755faee8fc71d43e7670372d5e36e4b09db9c91286dbcba65e5c0df6cb36c804a2d851c32f383594a9323cfce5fe8e9ec7e2bb0cd622a3b5

  • SSDEEP

    12288:0zflzF0dlxnesM2ZlE4xctklg4dt4c9/hu:0LlUbMuaklz4c9/8

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      47837aca56584222061e2e76d03903c5cadb21ef8ec9c431c7e3bb4fb21c19fd

    • Size

      409KB

    • MD5

      1044d2c396d4592f7726f7a6ac5e4e56

    • SHA1

      54c33a991f9ec4448352507a4585a7f951e4f205

    • SHA256

      47837aca56584222061e2e76d03903c5cadb21ef8ec9c431c7e3bb4fb21c19fd

    • SHA512

      09c16fa592c884a1755faee8fc71d43e7670372d5e36e4b09db9c91286dbcba65e5c0df6cb36c804a2d851c32f383594a9323cfce5fe8e9ec7e2bb0cd622a3b5

    • SSDEEP

      12288:0zflzF0dlxnesM2ZlE4xctklg4dt4c9/hu:0LlUbMuaklz4c9/8

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks