General

  • Target

    a688b6b2de462784eb63dd70e9b284a05dfae3d29aa83f0236dea492e83615fa

  • Size

    407KB

  • Sample

    241105-pw8gjatnan

  • MD5

    8d640f14045e0425f953ba996244908a

  • SHA1

    a7e86463c149fbebdd3e11659b01f6c2f5b7fc4b

  • SHA256

    a688b6b2de462784eb63dd70e9b284a05dfae3d29aa83f0236dea492e83615fa

  • SHA512

    d96851852c63793ff176db66543df7a7a464bdcf18a0faebd21f52c5963b79db944cf3b2d882c9e235fda781dc18fff49c8030095e5c8ee49393332c016dad9a

  • SSDEEP

    6144:fmlweoYLnJSOdr2dfKq6OpTzlbOf11nRwbD4tPc0hHJuIZz6m:fmlPoYr21wQRq1P+DqPc0hQYz6

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      a688b6b2de462784eb63dd70e9b284a05dfae3d29aa83f0236dea492e83615fa

    • Size

      407KB

    • MD5

      8d640f14045e0425f953ba996244908a

    • SHA1

      a7e86463c149fbebdd3e11659b01f6c2f5b7fc4b

    • SHA256

      a688b6b2de462784eb63dd70e9b284a05dfae3d29aa83f0236dea492e83615fa

    • SHA512

      d96851852c63793ff176db66543df7a7a464bdcf18a0faebd21f52c5963b79db944cf3b2d882c9e235fda781dc18fff49c8030095e5c8ee49393332c016dad9a

    • SSDEEP

      6144:fmlweoYLnJSOdr2dfKq6OpTzlbOf11nRwbD4tPc0hHJuIZz6m:fmlPoYr21wQRq1P+DqPc0hQYz6

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks