General

  • Target

    335d8d3eed564c618a23071f1780e3de78be0169beb1f4903fe2f3d2884d03f8

  • Size

    410KB

  • Sample

    241107-q3fwjatcjr

  • MD5

    f53c2393f0e922c58b82e5555e5e8e72

  • SHA1

    bf34da804cb2b03b66d91fd4f3492367298b6277

  • SHA256

    335d8d3eed564c618a23071f1780e3de78be0169beb1f4903fe2f3d2884d03f8

  • SHA512

    db68d8fcc86105e36f62cd46631ea230c48916758a295d957633eaf87f7e230f2c424dcae0e1fd82dd98c1a7fcfb66c7428bdbf0fd2cf7c0c22642ff80a0c67e

  • SSDEEP

    12288:M/9DO4eRk1hO2rjNl3k6bMVkpgkdpUejnNS:MJOX+dZWkp7Uejno

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      335d8d3eed564c618a23071f1780e3de78be0169beb1f4903fe2f3d2884d03f8

    • Size

      410KB

    • MD5

      f53c2393f0e922c58b82e5555e5e8e72

    • SHA1

      bf34da804cb2b03b66d91fd4f3492367298b6277

    • SHA256

      335d8d3eed564c618a23071f1780e3de78be0169beb1f4903fe2f3d2884d03f8

    • SHA512

      db68d8fcc86105e36f62cd46631ea230c48916758a295d957633eaf87f7e230f2c424dcae0e1fd82dd98c1a7fcfb66c7428bdbf0fd2cf7c0c22642ff80a0c67e

    • SSDEEP

      12288:M/9DO4eRk1hO2rjNl3k6bMVkpgkdpUejnNS:MJOX+dZWkp7Uejno

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks