General

  • Target

    c18dea21ee70f06b32e5a34bf95a8f9d229f8568c1b3a523efc9828592306dd2

  • Size

    409KB

  • Sample

    241106-1bdl7syaqe

  • MD5

    0397b9b3e869a65c6a0ffe6b0c674511

  • SHA1

    af7a3bb52320d6c0b167741f313c31d11a2cdb2d

  • SHA256

    c18dea21ee70f06b32e5a34bf95a8f9d229f8568c1b3a523efc9828592306dd2

  • SHA512

    1b51339a0c8a2413cc81c81903405454a269f0b106c76ebd706bc5c82d0f9c41a66cff42b6de7dcfb3fe0b707511cb2373a369fd4b34ddbb7f96c24a86734a55

  • SSDEEP

    12288:Kz7qo8NoxdK2Xb3B6rYl/cef0X7URydQpjNghF:QO7yxdbU/LUBpj6f

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      c18dea21ee70f06b32e5a34bf95a8f9d229f8568c1b3a523efc9828592306dd2

    • Size

      409KB

    • MD5

      0397b9b3e869a65c6a0ffe6b0c674511

    • SHA1

      af7a3bb52320d6c0b167741f313c31d11a2cdb2d

    • SHA256

      c18dea21ee70f06b32e5a34bf95a8f9d229f8568c1b3a523efc9828592306dd2

    • SHA512

      1b51339a0c8a2413cc81c81903405454a269f0b106c76ebd706bc5c82d0f9c41a66cff42b6de7dcfb3fe0b707511cb2373a369fd4b34ddbb7f96c24a86734a55

    • SSDEEP

      12288:Kz7qo8NoxdK2Xb3B6rYl/cef0X7URydQpjNghF:QO7yxdbU/LUBpj6f

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks