General

  • Target

    dc4334a608316cf49568439288b75841c3e831e1c055d751be02e10c35aecf86

  • Size

    389KB

  • Sample

    241107-m7yqcs1dma

  • MD5

    5ffd3655198b2bd33bbc219c04540838

  • SHA1

    1152aaa34a2c0b384e8988679f1194d8075ab7a3

  • SHA256

    dc4334a608316cf49568439288b75841c3e831e1c055d751be02e10c35aecf86

  • SHA512

    b4636cd6dc1dac27eaec98e5e5bcef7d7c9cdb450be9d4b8f674f1be3f1d6a9436ae01f96c9f5c2085532c9205be237c1a57cd504fcb6808a05456d671860fa4

  • SSDEEP

    6144:L3f8E8XvLnZrhGKAiXa3EP1Xau+ckJS5gyqaP2367L6MCOhxxFeTr/ekI:mzZrh9ABSNgEL6+zxF6L

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      dc4334a608316cf49568439288b75841c3e831e1c055d751be02e10c35aecf86

    • Size

      389KB

    • MD5

      5ffd3655198b2bd33bbc219c04540838

    • SHA1

      1152aaa34a2c0b384e8988679f1194d8075ab7a3

    • SHA256

      dc4334a608316cf49568439288b75841c3e831e1c055d751be02e10c35aecf86

    • SHA512

      b4636cd6dc1dac27eaec98e5e5bcef7d7c9cdb450be9d4b8f674f1be3f1d6a9436ae01f96c9f5c2085532c9205be237c1a57cd504fcb6808a05456d671860fa4

    • SSDEEP

      6144:L3f8E8XvLnZrhGKAiXa3EP1Xau+ckJS5gyqaP2367L6MCOhxxFeTr/ekI:mzZrh9ABSNgEL6+zxF6L

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks