General

  • Target

    45166a5e47eaf0c972fdd2dcd24aecd3bdec7d96527a41111e313c26a1bf3001

  • Size

    239KB

  • Sample

    241106-ly3ghsydrk

  • MD5

    d66b3b8cc5f0f777f809114c7707b76e

  • SHA1

    542d0a5dcb2ce2e3ad96e13ef4c04f6a610a4042

  • SHA256

    45166a5e47eaf0c972fdd2dcd24aecd3bdec7d96527a41111e313c26a1bf3001

  • SHA512

    e866f0c1daf3f3e76ae3013435fa97591ef508028ae89a23079470b1bc8fadb16d9788c5955227321c553a46f4f377f322a6a7700c47ef5258817c16264f1fce

  • SSDEEP

    6144:gP1gihGCd7otXqSqCkshfh9RlWJEPXZb3AO:QyihGCd7rKhL7KEPXZb

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      45166a5e47eaf0c972fdd2dcd24aecd3bdec7d96527a41111e313c26a1bf3001

    • Size

      239KB

    • MD5

      d66b3b8cc5f0f777f809114c7707b76e

    • SHA1

      542d0a5dcb2ce2e3ad96e13ef4c04f6a610a4042

    • SHA256

      45166a5e47eaf0c972fdd2dcd24aecd3bdec7d96527a41111e313c26a1bf3001

    • SHA512

      e866f0c1daf3f3e76ae3013435fa97591ef508028ae89a23079470b1bc8fadb16d9788c5955227321c553a46f4f377f322a6a7700c47ef5258817c16264f1fce

    • SSDEEP

      6144:gP1gihGCd7otXqSqCkshfh9RlWJEPXZb3AO:QyihGCd7rKhL7KEPXZb

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks