General

  • Target

    bd97477187ac818ff2165bef8d1cdf8778c42111e803ab2b1f42c15c8b5d28cd

  • Size

    382KB

  • Sample

    241106-2txy8szfnr

  • MD5

    5be750069809882bb53dbfdb4865dfc0

  • SHA1

    cf68b21ce5b9fc861f375a0ae3d891a00fce5925

  • SHA256

    bd97477187ac818ff2165bef8d1cdf8778c42111e803ab2b1f42c15c8b5d28cd

  • SHA512

    4496c1faebfe5cdb4ec0e2f8078db010876fe5330a71d4d846eba67a73b842ddecda00730076a7e33fbc4c63c868d06ea87d406e15745a80c786fd8d98c4a8a1

  • SSDEEP

    6144:fFxwmS9ueC29zYZPZVWgV1XnNkzet6Kc/vu8J5QLX:9xjMuYzYZPZVWgV1XnNr4Kc/vgLX

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      bd97477187ac818ff2165bef8d1cdf8778c42111e803ab2b1f42c15c8b5d28cd

    • Size

      382KB

    • MD5

      5be750069809882bb53dbfdb4865dfc0

    • SHA1

      cf68b21ce5b9fc861f375a0ae3d891a00fce5925

    • SHA256

      bd97477187ac818ff2165bef8d1cdf8778c42111e803ab2b1f42c15c8b5d28cd

    • SHA512

      4496c1faebfe5cdb4ec0e2f8078db010876fe5330a71d4d846eba67a73b842ddecda00730076a7e33fbc4c63c868d06ea87d406e15745a80c786fd8d98c4a8a1

    • SSDEEP

      6144:fFxwmS9ueC29zYZPZVWgV1XnNkzet6Kc/vu8J5QLX:9xjMuYzYZPZVWgV1XnNr4Kc/vgLX

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks