General

  • Target

    12750d98cf04799e68053c38744e8789f3b5649a735174d80851f106e800dcc0

  • Size

    363KB

  • Sample

    241107-e7ctwswdkl

  • MD5

    bcb0e383f4c283a91c20b908bbd3d647

  • SHA1

    0be7e94747e8b81270ca099b81a1c8c76720996d

  • SHA256

    12750d98cf04799e68053c38744e8789f3b5649a735174d80851f106e800dcc0

  • SHA512

    18a1f4dd1cffe9cd95b4db1f943b4cfb777e169d9bb0bc9f96a562427e81351b2acdb64d0e7684484ed1ecf5eb90df7ea90529fe2bf7a40a6b0a388497b77394

  • SSDEEP

    6144:UJ4yCCKwdWSfMzAlc5cpcMVbDlv5RVLjDL4gqX7tNfVXVHQLIiu8cfo0/pW:UOyCXwdWSfzl2cXVNvxvwZGEX8cA0/M

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      12750d98cf04799e68053c38744e8789f3b5649a735174d80851f106e800dcc0

    • Size

      363KB

    • MD5

      bcb0e383f4c283a91c20b908bbd3d647

    • SHA1

      0be7e94747e8b81270ca099b81a1c8c76720996d

    • SHA256

      12750d98cf04799e68053c38744e8789f3b5649a735174d80851f106e800dcc0

    • SHA512

      18a1f4dd1cffe9cd95b4db1f943b4cfb777e169d9bb0bc9f96a562427e81351b2acdb64d0e7684484ed1ecf5eb90df7ea90529fe2bf7a40a6b0a388497b77394

    • SSDEEP

      6144:UJ4yCCKwdWSfMzAlc5cpcMVbDlv5RVLjDL4gqX7tNfVXVHQLIiu8cfo0/pW:UOyCXwdWSfzl2cXVNvxvwZGEX8cA0/M

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks