General

  • Target

    ef8ef9724dc0f8887cfa03b1550af65b55376458be7dbef4defbf014d2dc6806

  • Size

    226KB

  • Sample

    241105-ypf85szngj

  • MD5

    63035272fa04b2df1c69f0cd4f480008

  • SHA1

    27392dd6314fcf0ea95d079c9654cb6551daf73d

  • SHA256

    ef8ef9724dc0f8887cfa03b1550af65b55376458be7dbef4defbf014d2dc6806

  • SHA512

    f0fc43730ec0f239f52889ce589a5a161096d9efbc236f53cee9ab03a0f622f12e7073a81a133c9b056446db7e33421e0222799eb44bb32ee1caaf3b14448ccb

  • SSDEEP

    3072:bOYqdvsy/N/xRT4XekwtIKFUV10rR0qPozxI1vzAeW/ONhUo9nF5QBkp6YV:bOFdEyVZRT4uvYVMgm7m0mOj6

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      ef8ef9724dc0f8887cfa03b1550af65b55376458be7dbef4defbf014d2dc6806

    • Size

      226KB

    • MD5

      63035272fa04b2df1c69f0cd4f480008

    • SHA1

      27392dd6314fcf0ea95d079c9654cb6551daf73d

    • SHA256

      ef8ef9724dc0f8887cfa03b1550af65b55376458be7dbef4defbf014d2dc6806

    • SHA512

      f0fc43730ec0f239f52889ce589a5a161096d9efbc236f53cee9ab03a0f622f12e7073a81a133c9b056446db7e33421e0222799eb44bb32ee1caaf3b14448ccb

    • SSDEEP

      3072:bOYqdvsy/N/xRT4XekwtIKFUV10rR0qPozxI1vzAeW/ONhUo9nF5QBkp6YV:bOFdEyVZRT4uvYVMgm7m0mOj6

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks