General

  • Target

    ddebce3b81d9356b1dcf43e0016587c48ea586a153506be2527b1c1b47668e32

  • Size

    284KB

  • Sample

    241106-lkz48sxjfs

  • MD5

    1c4bcbfa762d0439e1b0e67d8e9e37e3

  • SHA1

    bb6d17465083e5c35a2a35c108ea807b92f7d740

  • SHA256

    ddebce3b81d9356b1dcf43e0016587c48ea586a153506be2527b1c1b47668e32

  • SHA512

    c4d27d767b6d12ce9a2661e05d9d7969ad23f5ecf25063d1b7141c168bf7093b36e82b05b118acd0fb17d7ae7b41dc25ad3fa2a15bcd3e544f5bf6d83c397022

  • SSDEEP

    6144:JinfcANCg0k6JWB627IyObLtvWb3DLcPI1U4eNDuSzC:gnffNCgvlihvmzYI1fAC

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      ddebce3b81d9356b1dcf43e0016587c48ea586a153506be2527b1c1b47668e32

    • Size

      284KB

    • MD5

      1c4bcbfa762d0439e1b0e67d8e9e37e3

    • SHA1

      bb6d17465083e5c35a2a35c108ea807b92f7d740

    • SHA256

      ddebce3b81d9356b1dcf43e0016587c48ea586a153506be2527b1c1b47668e32

    • SHA512

      c4d27d767b6d12ce9a2661e05d9d7969ad23f5ecf25063d1b7141c168bf7093b36e82b05b118acd0fb17d7ae7b41dc25ad3fa2a15bcd3e544f5bf6d83c397022

    • SSDEEP

      6144:JinfcANCg0k6JWB627IyObLtvWb3DLcPI1U4eNDuSzC:gnffNCgvlihvmzYI1fAC

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks