General

  • Target

    aab3c0fafd6c7090135272e2af83f9413917b9dbf16dc6e9ae6ac00daaaec99b

  • Size

    409KB

  • Sample

    241107-cblqtataqm

  • MD5

    b2fc7ea05c01398cad30987113466179

  • SHA1

    fee1ed37ad0335a208bd03b24bed7879b3405195

  • SHA256

    aab3c0fafd6c7090135272e2af83f9413917b9dbf16dc6e9ae6ac00daaaec99b

  • SHA512

    9cebfe77c425af08b47203560e1b831d26d48dc56810a9170b158f4fa82768f7f54577128eb361e1430598aad14d34c7f013b0493a0ff26219add5b94299737c

  • SSDEEP

    6144:yfwrQ5tjPMu1WPNylTQSdiKI5wAt7E7I7flHyd6rrKf4RXIa6g8B6xxxpe:yYUvjUu1UyxdiKR4sWflHyd6/KfzV56

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      aab3c0fafd6c7090135272e2af83f9413917b9dbf16dc6e9ae6ac00daaaec99b

    • Size

      409KB

    • MD5

      b2fc7ea05c01398cad30987113466179

    • SHA1

      fee1ed37ad0335a208bd03b24bed7879b3405195

    • SHA256

      aab3c0fafd6c7090135272e2af83f9413917b9dbf16dc6e9ae6ac00daaaec99b

    • SHA512

      9cebfe77c425af08b47203560e1b831d26d48dc56810a9170b158f4fa82768f7f54577128eb361e1430598aad14d34c7f013b0493a0ff26219add5b94299737c

    • SSDEEP

      6144:yfwrQ5tjPMu1WPNylTQSdiKI5wAt7E7I7flHyd6rrKf4RXIa6g8B6xxxpe:yYUvjUu1UyxdiKR4sWflHyd6/KfzV56

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks