General

  • Target

    bc7ca052ef31b5338251f3fd491b3437b9c08c3640808cff284b65ccc0e0070f

  • Size

    359KB

  • Sample

    241105-recpms1raw

  • MD5

    5b04bd5d1770a043c1f2e7b7c8481ce9

  • SHA1

    e942edd843450beb4308592fb863b32ef1865025

  • SHA256

    bc7ca052ef31b5338251f3fd491b3437b9c08c3640808cff284b65ccc0e0070f

  • SHA512

    7b0e5e21039647f14c4f096d2559f12410558063045cc985008340b48fff6181be4a307253aa09a2a6f9fbb152a58b36d96c243cf3171152440cff651733dbe8

  • SSDEEP

    6144:+VGIcKKHhtpE+exgTojel3VN105rEqGLjtRQozEC82cFI/LHlbr2k:+VG9KKHXpmScC3Tzq09AgmKFbh

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      bc7ca052ef31b5338251f3fd491b3437b9c08c3640808cff284b65ccc0e0070f

    • Size

      359KB

    • MD5

      5b04bd5d1770a043c1f2e7b7c8481ce9

    • SHA1

      e942edd843450beb4308592fb863b32ef1865025

    • SHA256

      bc7ca052ef31b5338251f3fd491b3437b9c08c3640808cff284b65ccc0e0070f

    • SHA512

      7b0e5e21039647f14c4f096d2559f12410558063045cc985008340b48fff6181be4a307253aa09a2a6f9fbb152a58b36d96c243cf3171152440cff651733dbe8

    • SSDEEP

      6144:+VGIcKKHhtpE+exgTojel3VN105rEqGLjtRQozEC82cFI/LHlbr2k:+VG9KKHXpmScC3Tzq09AgmKFbh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks