General

  • Target

    4ea1f0d925429631e7c473c99cf48c2ae9b74053bc422e449d8e762ba87418a2

  • Size

    409KB

  • Sample

    241106-wvss1stqgw

  • MD5

    4b0203fcca34f4ec8de3402a65d0143f

  • SHA1

    95704e8468017e5f307806b031d180479898ab1b

  • SHA256

    4ea1f0d925429631e7c473c99cf48c2ae9b74053bc422e449d8e762ba87418a2

  • SHA512

    1fcd6f242350f6749a6d4694d887c60c2efad341f3e12f01621960725fc6f5ffcc8267c361a6c9fa8459357c09d6a1835206b8b6951c224ba06610a468ba21eb

  • SSDEEP

    12288:K9z+wDS+4Acz9X+ra09mEr1G/UYidb+qLno/SL:6nDS+5cz9X+mUf+q7tL

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      4ea1f0d925429631e7c473c99cf48c2ae9b74053bc422e449d8e762ba87418a2

    • Size

      409KB

    • MD5

      4b0203fcca34f4ec8de3402a65d0143f

    • SHA1

      95704e8468017e5f307806b031d180479898ab1b

    • SHA256

      4ea1f0d925429631e7c473c99cf48c2ae9b74053bc422e449d8e762ba87418a2

    • SHA512

      1fcd6f242350f6749a6d4694d887c60c2efad341f3e12f01621960725fc6f5ffcc8267c361a6c9fa8459357c09d6a1835206b8b6951c224ba06610a468ba21eb

    • SSDEEP

      12288:K9z+wDS+4Acz9X+ra09mEr1G/UYidb+qLno/SL:6nDS+5cz9X+mUf+q7tL

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks