General

  • Target

    f356b4cbcddf19b0b3b4dd01d7d31120cc6fc5860ca7bb89eaf6f8600c420797

  • Size

    252KB

  • Sample

    241105-lcvjsaxqdw

  • MD5

    a568dfb7e1f23431d847c0c76f99c2cc

  • SHA1

    144108a913e3d1607fba94774b3cda48bda3d071

  • SHA256

    f356b4cbcddf19b0b3b4dd01d7d31120cc6fc5860ca7bb89eaf6f8600c420797

  • SHA512

    0a79167e6f602501423c17f3eed055dc8d29eb7f5279f81bb72252cff8475fa0b3ea39c53ae6b809239030f0ff34585caf86c7546650f91d50b2a3cbe61bc5d2

  • SSDEEP

    3072:FMRo8sjFNKpurFlmNlwjPEYT6E2XBVjYOjASMmpHLsb/czX8t+3TwXBFvlkN75oH:CuCGFlmNcwXBlSSMvb0zst+8j+KW

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.20:13441

Targets

    • Target

      f356b4cbcddf19b0b3b4dd01d7d31120cc6fc5860ca7bb89eaf6f8600c420797

    • Size

      252KB

    • MD5

      a568dfb7e1f23431d847c0c76f99c2cc

    • SHA1

      144108a913e3d1607fba94774b3cda48bda3d071

    • SHA256

      f356b4cbcddf19b0b3b4dd01d7d31120cc6fc5860ca7bb89eaf6f8600c420797

    • SHA512

      0a79167e6f602501423c17f3eed055dc8d29eb7f5279f81bb72252cff8475fa0b3ea39c53ae6b809239030f0ff34585caf86c7546650f91d50b2a3cbe61bc5d2

    • SSDEEP

      3072:FMRo8sjFNKpurFlmNlwjPEYT6E2XBVjYOjASMmpHLsb/czX8t+3TwXBFvlkN75oH:CuCGFlmNcwXBlSSMvb0zst+8j+KW

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks