General

  • Target

    e113a052ffb29d661a71eed9475d77b1a4623e11f343198f664924158fa3aad8

  • Size

    240KB

  • Sample

    241107-abzass1fmm

  • MD5

    b8c61314c24df62617c376202f785091

  • SHA1

    64c0b6d100e076c3ea6f200e4b07722e05fc121c

  • SHA256

    e113a052ffb29d661a71eed9475d77b1a4623e11f343198f664924158fa3aad8

  • SHA512

    8aa96ac54e0d3cd04fcd07faf1f82e9b9cfe1004a6c84b1288ceb9d0e8831c8592179cca20242f962a128977c3ca1fb2d9450f328e2b2bea7a53e54948b39632

  • SSDEEP

    3072:jBPv9cnFZh2w8utUtNiXqR2WTEwVEc3cmVENLwAAnyj8pU57GyLxJ40O:j14FZh2Pugsa5EEvsLwyj8ByN9O

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      e113a052ffb29d661a71eed9475d77b1a4623e11f343198f664924158fa3aad8

    • Size

      240KB

    • MD5

      b8c61314c24df62617c376202f785091

    • SHA1

      64c0b6d100e076c3ea6f200e4b07722e05fc121c

    • SHA256

      e113a052ffb29d661a71eed9475d77b1a4623e11f343198f664924158fa3aad8

    • SHA512

      8aa96ac54e0d3cd04fcd07faf1f82e9b9cfe1004a6c84b1288ceb9d0e8831c8592179cca20242f962a128977c3ca1fb2d9450f328e2b2bea7a53e54948b39632

    • SSDEEP

      3072:jBPv9cnFZh2w8utUtNiXqR2WTEwVEc3cmVENLwAAnyj8pU57GyLxJ40O:j14FZh2Pugsa5EEvsLwyj8ByN9O

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks