General

  • Target

    071c13e4fd03c640f158e84a3e8d137d04fd6c88420de0a88c8fa1d41d6e8648

  • Size

    381KB

  • Sample

    241107-tdqwzsxpdn

  • MD5

    96660912f3899205c7ecc954a0b25711

  • SHA1

    be8c4ed0e8d2fa72ffd1f95429ceb0bd4245694d

  • SHA256

    071c13e4fd03c640f158e84a3e8d137d04fd6c88420de0a88c8fa1d41d6e8648

  • SHA512

    0dd131c20bbda5aa5171ad95e2400f8eaca0760724ba981618739797d6ba6d54cd4062a002dafdf22db5cae7fbaa935adde39d5d535c45c0cd3a05d1ca3d4542

  • SSDEEP

    6144:9UiFOP2Q92OsFPYaEAZ9PUW1tRlJUl1AHOT7DgjfcCyAw22uEU:9FOP2Q92RF79PB3lZSqfFw2z

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      071c13e4fd03c640f158e84a3e8d137d04fd6c88420de0a88c8fa1d41d6e8648

    • Size

      381KB

    • MD5

      96660912f3899205c7ecc954a0b25711

    • SHA1

      be8c4ed0e8d2fa72ffd1f95429ceb0bd4245694d

    • SHA256

      071c13e4fd03c640f158e84a3e8d137d04fd6c88420de0a88c8fa1d41d6e8648

    • SHA512

      0dd131c20bbda5aa5171ad95e2400f8eaca0760724ba981618739797d6ba6d54cd4062a002dafdf22db5cae7fbaa935adde39d5d535c45c0cd3a05d1ca3d4542

    • SSDEEP

      6144:9UiFOP2Q92OsFPYaEAZ9PUW1tRlJUl1AHOT7DgjfcCyAw22uEU:9FOP2Q92RF79PB3lZSqfFw2z

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks