General

  • Target

    2e5968fcd98db6a66461532d69afa0b9bd0e7ca67e0104750d8c40f6f8f35537

  • Size

    249KB

  • Sample

    241105-q2x4esshkr

  • MD5

    71c5160b9737d675d163dfb3ff3f9e6d

  • SHA1

    146b073b9ef3e9f197fd4a68ac6b17f04cdba35a

  • SHA256

    2e5968fcd98db6a66461532d69afa0b9bd0e7ca67e0104750d8c40f6f8f35537

  • SHA512

    0c89c97bde333121bc431e65a47fb14b1a9550399a01d9ca44bc21ef28e2a676c166ae6694c29a3914de5206d2c056a635e1fc9e49d2f8f96c48a72099e3ad63

  • SSDEEP

    6144:j1VNENCz6GERPQlJqX6y6pTnTA4Kwgnz/8Ea:3NENV5ulemTTAwsW

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      2e5968fcd98db6a66461532d69afa0b9bd0e7ca67e0104750d8c40f6f8f35537

    • Size

      249KB

    • MD5

      71c5160b9737d675d163dfb3ff3f9e6d

    • SHA1

      146b073b9ef3e9f197fd4a68ac6b17f04cdba35a

    • SHA256

      2e5968fcd98db6a66461532d69afa0b9bd0e7ca67e0104750d8c40f6f8f35537

    • SHA512

      0c89c97bde333121bc431e65a47fb14b1a9550399a01d9ca44bc21ef28e2a676c166ae6694c29a3914de5206d2c056a635e1fc9e49d2f8f96c48a72099e3ad63

    • SSDEEP

      6144:j1VNENCz6GERPQlJqX6y6pTnTA4Kwgnz/8Ea:3NENV5ulemTTAwsW

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks