General

  • Target

    2c0bad9352cc399b854bfb1caf599861a30db1362c2eca503222f9d23d6dca4b

  • Size

    360KB

  • Sample

    241107-t3nsxsykdq

  • MD5

    abcd8540e6cc3b6fe3132ec85ab7e7ab

  • SHA1

    52ae938c695d8f32f797c963e8d28e250e96e718

  • SHA256

    2c0bad9352cc399b854bfb1caf599861a30db1362c2eca503222f9d23d6dca4b

  • SHA512

    95b8f3e017118430932e1bd91224e4efbc6fb08a70f338ed3c060b6c08b93eed994f9f8e6e86ef229455a236d698ef8cdde3740eb8fd44f71c7a8baad294a546

  • SSDEEP

    6144:aUrmyHMAEfb9ZbiQusexXfQgi6f8MSK9G2lh3G:aUrmyHMAEfbSQAv5/8MSwG2lc

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      2c0bad9352cc399b854bfb1caf599861a30db1362c2eca503222f9d23d6dca4b

    • Size

      360KB

    • MD5

      abcd8540e6cc3b6fe3132ec85ab7e7ab

    • SHA1

      52ae938c695d8f32f797c963e8d28e250e96e718

    • SHA256

      2c0bad9352cc399b854bfb1caf599861a30db1362c2eca503222f9d23d6dca4b

    • SHA512

      95b8f3e017118430932e1bd91224e4efbc6fb08a70f338ed3c060b6c08b93eed994f9f8e6e86ef229455a236d698ef8cdde3740eb8fd44f71c7a8baad294a546

    • SSDEEP

      6144:aUrmyHMAEfb9ZbiQusexXfQgi6f8MSK9G2lh3G:aUrmyHMAEfbSQAv5/8MSwG2lc

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks