General

  • Target

    49b13bd0f7abe009f15e1fb11df3beecadef9a22ca11c54aeccf546eabfb430a

  • Size

    410KB

  • Sample

    241106-2l7hps1rbj

  • MD5

    fac722be665ce07ab06fe46bc4dcdcb6

  • SHA1

    40c027f6e7996a5807f9e75bf9e127e17f0638e1

  • SHA256

    49b13bd0f7abe009f15e1fb11df3beecadef9a22ca11c54aeccf546eabfb430a

  • SHA512

    43efd0e039f3cc4f4cea48ddba335f0afe59c03b2b6563bc6ace1977718c44b77af92644a0d3dbba385835b57beb08902ee9327401afc8c26769aecdd53f5815

  • SSDEEP

    12288:KRdCmNAz0S5Be6ozyb45/UJxYVUdqd4yK/vTB701mu:+p6B5Be6ozyx6UNyKXaM

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      49b13bd0f7abe009f15e1fb11df3beecadef9a22ca11c54aeccf546eabfb430a

    • Size

      410KB

    • MD5

      fac722be665ce07ab06fe46bc4dcdcb6

    • SHA1

      40c027f6e7996a5807f9e75bf9e127e17f0638e1

    • SHA256

      49b13bd0f7abe009f15e1fb11df3beecadef9a22ca11c54aeccf546eabfb430a

    • SHA512

      43efd0e039f3cc4f4cea48ddba335f0afe59c03b2b6563bc6ace1977718c44b77af92644a0d3dbba385835b57beb08902ee9327401afc8c26769aecdd53f5815

    • SSDEEP

      12288:KRdCmNAz0S5Be6ozyb45/UJxYVUdqd4yK/vTB701mu:+p6B5Be6ozyx6UNyKXaM

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks