General

  • Target

    b10053a10a563d488e6d531dbfb3161470bf995c16fa7dde5c2f34dfef433761

  • Size

    250KB

  • Sample

    241106-k91avszmfj

  • MD5

    dd10f61961e65353571abcbd814cc2db

  • SHA1

    d65ed78e4de4eebb7ce1ae02586298cf144dc54f

  • SHA256

    b10053a10a563d488e6d531dbfb3161470bf995c16fa7dde5c2f34dfef433761

  • SHA512

    c474ec527d394827bbe45fe35c0704e5231e8c9c5d08f61cce70bbbc879a6a85acc10449db13a1897a0b5da4cdbc84afb606923cab1e9223bdb61130ba1c932a

  • SSDEEP

    6144:+6Q0Mcmb9jIWbEEdQuo5C1MoxhMLO1Ea:60Mci9iEJo5X+hUk

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      b10053a10a563d488e6d531dbfb3161470bf995c16fa7dde5c2f34dfef433761

    • Size

      250KB

    • MD5

      dd10f61961e65353571abcbd814cc2db

    • SHA1

      d65ed78e4de4eebb7ce1ae02586298cf144dc54f

    • SHA256

      b10053a10a563d488e6d531dbfb3161470bf995c16fa7dde5c2f34dfef433761

    • SHA512

      c474ec527d394827bbe45fe35c0704e5231e8c9c5d08f61cce70bbbc879a6a85acc10449db13a1897a0b5da4cdbc84afb606923cab1e9223bdb61130ba1c932a

    • SSDEEP

      6144:+6Q0Mcmb9jIWbEEdQuo5C1MoxhMLO1Ea:60Mci9iEJo5X+hUk

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks