General

  • Target

    c3d6901760d1f48d6278fcdb513d2917e485e150b3792c7f7e7847179f574904

  • Size

    369KB

  • Sample

    241107-d9mansvdmc

  • MD5

    09de830293257a5ac140365b90509da0

  • SHA1

    eab1f3a755bbf2709fa7be504c36a3260e2013a5

  • SHA256

    c3d6901760d1f48d6278fcdb513d2917e485e150b3792c7f7e7847179f574904

  • SHA512

    31214ef25903d9a27372e95a45f83f828c1ad45537f15d766ce8b0cded1a62a6b8d0e75c53d5504f1d045d7272197964eebee51583e8c31701134701b15d1773

  • SSDEEP

    6144:AsnHpTzW7Lq7r7q8ecqV7w8z1y5yECZ5GziYywhrzC0:1yLq7r73eRV79z1y5eGziYywBz

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      c3d6901760d1f48d6278fcdb513d2917e485e150b3792c7f7e7847179f574904

    • Size

      369KB

    • MD5

      09de830293257a5ac140365b90509da0

    • SHA1

      eab1f3a755bbf2709fa7be504c36a3260e2013a5

    • SHA256

      c3d6901760d1f48d6278fcdb513d2917e485e150b3792c7f7e7847179f574904

    • SHA512

      31214ef25903d9a27372e95a45f83f828c1ad45537f15d766ce8b0cded1a62a6b8d0e75c53d5504f1d045d7272197964eebee51583e8c31701134701b15d1773

    • SSDEEP

      6144:AsnHpTzW7Lq7r7q8ecqV7w8z1y5yECZ5GziYywhrzC0:1yLq7r73eRV79z1y5eGziYywBz

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks