General

  • Target

    c4e041798fc99d855c6a9f6b87dbbea4b5e27113d95b16a0f1720dc6c0482bb1

  • Size

    407KB

  • Sample

    241107-dzj3kavbma

  • MD5

    89ec1c90b688a91198fff1aff9674289

  • SHA1

    6f24b388eb14e0dd199d73f8a68cdbbbdaf60766

  • SHA256

    c4e041798fc99d855c6a9f6b87dbbea4b5e27113d95b16a0f1720dc6c0482bb1

  • SHA512

    2c253194cf70113b123063a4bdbcab89233a7d0e049c21d78cb9da9bb2cc12212f3690967195203a9f943d802978bc91b036025da5546160d90591a7f1fcfd7e

  • SSDEEP

    6144:P0Q4sKTcJlBJEDUR5IfQHnsqVYJ1c+PNT67zz9HDFIZ46lH3K:P0QjbLYUZHvXENO7zz9pY46l6

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      c4e041798fc99d855c6a9f6b87dbbea4b5e27113d95b16a0f1720dc6c0482bb1

    • Size

      407KB

    • MD5

      89ec1c90b688a91198fff1aff9674289

    • SHA1

      6f24b388eb14e0dd199d73f8a68cdbbbdaf60766

    • SHA256

      c4e041798fc99d855c6a9f6b87dbbea4b5e27113d95b16a0f1720dc6c0482bb1

    • SHA512

      2c253194cf70113b123063a4bdbcab89233a7d0e049c21d78cb9da9bb2cc12212f3690967195203a9f943d802978bc91b036025da5546160d90591a7f1fcfd7e

    • SSDEEP

      6144:P0Q4sKTcJlBJEDUR5IfQHnsqVYJ1c+PNT67zz9HDFIZ46lH3K:P0QjbLYUZHvXENO7zz9pY46l6

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks