General

  • Target

    b86c7a13748a6fc24dc01212e9f47c81fc421077dd89b307ae977bd7285ae5f8

  • Size

    337KB

  • Sample

    241105-vd7eeavclc

  • MD5

    14c5bcb9841835b9f24070e3892138c5

  • SHA1

    e0c65c81f06c1f0ba383a3e1794cc51cc4ed8b5c

  • SHA256

    b86c7a13748a6fc24dc01212e9f47c81fc421077dd89b307ae977bd7285ae5f8

  • SHA512

    9ab879fede3e0f82912ba2a748a08acb68aba4f113070549b51278e22d3c533f3def865daa4d6624d084913faa62f0b244b1f224439e213516bcc6909d7fbc2a

  • SSDEEP

    6144:FI6QtkDqYRt1IJTZPQVu9fX9APeAye6dvFFdIADG8el:FxQtkD9yTZPQVYf2mFdxD

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      b86c7a13748a6fc24dc01212e9f47c81fc421077dd89b307ae977bd7285ae5f8

    • Size

      337KB

    • MD5

      14c5bcb9841835b9f24070e3892138c5

    • SHA1

      e0c65c81f06c1f0ba383a3e1794cc51cc4ed8b5c

    • SHA256

      b86c7a13748a6fc24dc01212e9f47c81fc421077dd89b307ae977bd7285ae5f8

    • SHA512

      9ab879fede3e0f82912ba2a748a08acb68aba4f113070549b51278e22d3c533f3def865daa4d6624d084913faa62f0b244b1f224439e213516bcc6909d7fbc2a

    • SSDEEP

      6144:FI6QtkDqYRt1IJTZPQVu9fX9APeAye6dvFFdIADG8el:FxQtkD9yTZPQVYf2mFdxD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks