General

  • Target

    66d758356ee69f7666b3d34b1f4419ac600aa25cb15eff2e32e498509364a854

  • Size

    319KB

  • Sample

    241107-kpehnaylbs

  • MD5

    1a3d211b8fb10ba41da1ce2f3955b330

  • SHA1

    478a1afc8fd41d5d7cf7e1e69662fdfefa2e3409

  • SHA256

    66d758356ee69f7666b3d34b1f4419ac600aa25cb15eff2e32e498509364a854

  • SHA512

    2d807775f4bb604583f897555e21d0659acfe0a3863ce7f5e98cc02639f91a27a485b6d2f9a30a40f60da8070aecb85319a1c5fd5bf9d327414083d435a6cf05

  • SSDEEP

    6144:hSp7LnxCQeylfbbP10mzk9WXP1IDv1Vug/OV+gOrihVO:MbxCQeylfP29+PKDNVToEYV

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.20:13441

Targets

    • Target

      66d758356ee69f7666b3d34b1f4419ac600aa25cb15eff2e32e498509364a854

    • Size

      319KB

    • MD5

      1a3d211b8fb10ba41da1ce2f3955b330

    • SHA1

      478a1afc8fd41d5d7cf7e1e69662fdfefa2e3409

    • SHA256

      66d758356ee69f7666b3d34b1f4419ac600aa25cb15eff2e32e498509364a854

    • SHA512

      2d807775f4bb604583f897555e21d0659acfe0a3863ce7f5e98cc02639f91a27a485b6d2f9a30a40f60da8070aecb85319a1c5fd5bf9d327414083d435a6cf05

    • SSDEEP

      6144:hSp7LnxCQeylfbbP10mzk9WXP1IDv1Vug/OV+gOrihVO:MbxCQeylfP29+PKDNVToEYV

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks