General

  • Target

    4e34d2c77b177a4435a263788bf1333e09f475a30e30cb9e040f462a8e9714a3

  • Size

    410KB

  • Sample

    241105-q3mzvashlr

  • MD5

    9ad13a5847e0964bb10965d07662b8b6

  • SHA1

    7db66b42bb1b301a3376c7171b82318f82d2fa81

  • SHA256

    4e34d2c77b177a4435a263788bf1333e09f475a30e30cb9e040f462a8e9714a3

  • SHA512

    ce46555770a8f5a30ed3da118e607512baae4d3235ef6d59bce25151bd1bcefb8428bd252bf80ed8a077d40e1f80d18758a9dc0b27fb262171d0ddd782e48aca

  • SSDEEP

    12288:97y1odbdgf51hMPG4zNkT7tkdgQdp4ddyVxNw:99pgB1h9JkdX4ddyB

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      4e34d2c77b177a4435a263788bf1333e09f475a30e30cb9e040f462a8e9714a3

    • Size

      410KB

    • MD5

      9ad13a5847e0964bb10965d07662b8b6

    • SHA1

      7db66b42bb1b301a3376c7171b82318f82d2fa81

    • SHA256

      4e34d2c77b177a4435a263788bf1333e09f475a30e30cb9e040f462a8e9714a3

    • SHA512

      ce46555770a8f5a30ed3da118e607512baae4d3235ef6d59bce25151bd1bcefb8428bd252bf80ed8a077d40e1f80d18758a9dc0b27fb262171d0ddd782e48aca

    • SSDEEP

      12288:97y1odbdgf51hMPG4zNkT7tkdgQdp4ddyVxNw:99pgB1h9JkdX4ddyB

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks