General

  • Target

    8985f078b2b214c58d5afc251201cd9bdd2c0700be7806ce674ff2aa66e77b70

  • Size

    252KB

  • Sample

    241105-pbry2stjgl

  • MD5

    75463d29918268c97196f9b81d681d9e

  • SHA1

    1419b1f7ab6904c6965ae206fd736f234bb55c5c

  • SHA256

    8985f078b2b214c58d5afc251201cd9bdd2c0700be7806ce674ff2aa66e77b70

  • SHA512

    550d7b45859d1e7fcc961bc58dee5b0048314b8e74f6e339c97fcc67dba17401c61c77e0ba40ed240597ed5d2b54525209683a56bda63d5ae433220983de5b87

  • SSDEEP

    6144:hVBVTt757/oBe6Ba8v6M/hwzuPgxChXa:hVTt7qE8vZpwzGFa

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      8985f078b2b214c58d5afc251201cd9bdd2c0700be7806ce674ff2aa66e77b70

    • Size

      252KB

    • MD5

      75463d29918268c97196f9b81d681d9e

    • SHA1

      1419b1f7ab6904c6965ae206fd736f234bb55c5c

    • SHA256

      8985f078b2b214c58d5afc251201cd9bdd2c0700be7806ce674ff2aa66e77b70

    • SHA512

      550d7b45859d1e7fcc961bc58dee5b0048314b8e74f6e339c97fcc67dba17401c61c77e0ba40ed240597ed5d2b54525209683a56bda63d5ae433220983de5b87

    • SSDEEP

      6144:hVBVTt757/oBe6Ba8v6M/hwzuPgxChXa:hVTt7qE8vZpwzGFa

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks