General

  • Target

    9a938e44353122bf2294f3ad8adb5295a24233473b1278222c3ba68938cfe723

  • Size

    360KB

  • Sample

    241106-t1lksatgrp

  • MD5

    799ea388708c86c818cab841fb6f5ba7

  • SHA1

    a1485e5a46fb2f10dc7a7d769d9a35b866e71fa9

  • SHA256

    9a938e44353122bf2294f3ad8adb5295a24233473b1278222c3ba68938cfe723

  • SHA512

    8c1a99c88bd365f981e60896f313058c80980e2c49d984b4b325d65eb25b6ae193d7c414b2c478a2c3e7c2dc5db87a26b45ae3bc222436a82f2593164e4b4825

  • SSDEEP

    6144:EFsfb4Jq0onDUy75sdYD2PsbzV4GuV+ZsSpKu+R9:EeD4Q06Uy5QYDVwVuE7R

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.20:13441

Targets

    • Target

      9a938e44353122bf2294f3ad8adb5295a24233473b1278222c3ba68938cfe723

    • Size

      360KB

    • MD5

      799ea388708c86c818cab841fb6f5ba7

    • SHA1

      a1485e5a46fb2f10dc7a7d769d9a35b866e71fa9

    • SHA256

      9a938e44353122bf2294f3ad8adb5295a24233473b1278222c3ba68938cfe723

    • SHA512

      8c1a99c88bd365f981e60896f313058c80980e2c49d984b4b325d65eb25b6ae193d7c414b2c478a2c3e7c2dc5db87a26b45ae3bc222436a82f2593164e4b4825

    • SSDEEP

      6144:EFsfb4Jq0onDUy75sdYD2PsbzV4GuV+ZsSpKu+R9:EeD4Q06Uy5QYDVwVuE7R

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks