General

  • Target

    b839603359303e06a147c8d5e98e5bb221eaefb5b7ed1b7006186d66bfc89b02

  • Size

    410KB

  • Sample

    241105-vwwqmaxpdn

  • MD5

    4b6406aa4ce4975a41d816c394aa946c

  • SHA1

    ff3934e46d87ddd4c3cf448868f5b87b7fd30ab8

  • SHA256

    b839603359303e06a147c8d5e98e5bb221eaefb5b7ed1b7006186d66bfc89b02

  • SHA512

    ec6ccc680506e523f40af95998de01c8725adaaebe83e7983894444ad8471bd573c0e5eb12576dd0f085d2d6f8ea7a189f6595d5fc18aed30de1caf02d353cb7

  • SSDEEP

    12288:KKLyGNjU1CkNpnXhC6Th6cUVKd2inSfQLz9:hF48kvJU7inGy9

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      b839603359303e06a147c8d5e98e5bb221eaefb5b7ed1b7006186d66bfc89b02

    • Size

      410KB

    • MD5

      4b6406aa4ce4975a41d816c394aa946c

    • SHA1

      ff3934e46d87ddd4c3cf448868f5b87b7fd30ab8

    • SHA256

      b839603359303e06a147c8d5e98e5bb221eaefb5b7ed1b7006186d66bfc89b02

    • SHA512

      ec6ccc680506e523f40af95998de01c8725adaaebe83e7983894444ad8471bd573c0e5eb12576dd0f085d2d6f8ea7a189f6595d5fc18aed30de1caf02d353cb7

    • SSDEEP

      12288:KKLyGNjU1CkNpnXhC6Th6cUVKd2inSfQLz9:hF48kvJU7inGy9

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks