General

  • Target

    8c1118cbb5a026809c0a4377c0d1e7af00e6903ce5f7e2ee9dab91add6898bb3

  • Size

    345KB

  • Sample

    241105-r6chysvrcp

  • MD5

    de0572fb7701a06d190696882ca9dee4

  • SHA1

    0f11a750ab3ec3b248e7cb35cd281388ce691c0a

  • SHA256

    8c1118cbb5a026809c0a4377c0d1e7af00e6903ce5f7e2ee9dab91add6898bb3

  • SHA512

    7960bce44f06b6db5f5ffc9c1fb2c8e31ce8df50d14024afda290ca10233766a87d5c099de398ff8248c58914a60e696b18e57c0f57e657afc20d129e588e801

  • SSDEEP

    6144:bAkEeey2+28ALEeUgCAgSYfL690LfPrTO43vF9YfUGlRitB01:f0y2+28ALovArEKmTO4nCriv0

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      8c1118cbb5a026809c0a4377c0d1e7af00e6903ce5f7e2ee9dab91add6898bb3

    • Size

      345KB

    • MD5

      de0572fb7701a06d190696882ca9dee4

    • SHA1

      0f11a750ab3ec3b248e7cb35cd281388ce691c0a

    • SHA256

      8c1118cbb5a026809c0a4377c0d1e7af00e6903ce5f7e2ee9dab91add6898bb3

    • SHA512

      7960bce44f06b6db5f5ffc9c1fb2c8e31ce8df50d14024afda290ca10233766a87d5c099de398ff8248c58914a60e696b18e57c0f57e657afc20d129e588e801

    • SSDEEP

      6144:bAkEeey2+28ALEeUgCAgSYfL690LfPrTO43vF9YfUGlRitB01:f0y2+28ALovArEKmTO4nCriv0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks