General

  • Target

    65a9a594ab307fc520a599f3ba1cb81665a09bbb97d0baf1a326b06d5a74cf10

  • Size

    292KB

  • Sample

    241107-trrenswajq

  • MD5

    cea5368826643db52889abb3ca7a4304

  • SHA1

    d93379ff367aac3979c17a36f72c1bda9adb628c

  • SHA256

    65a9a594ab307fc520a599f3ba1cb81665a09bbb97d0baf1a326b06d5a74cf10

  • SHA512

    8873ef1717869a0b7a92f739e8576c69f72694ba62aaf23f34c55243080f2f74ec9ee2d04ad1931a204161001d8c24dbb2a428734d4ea7ccb4d0be2ca4b0a8cb

  • SSDEEP

    3072:pY9QSHF8Tkq1H8g03W0c6ZK5ZE+wBXwYDPmIYgpEK5p2zxy2AXur4oXkzxvE57kv:dSHU8g066zGCPYg+K5kzZOoixu+aGD0

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.20:13441

Targets

    • Target

      65a9a594ab307fc520a599f3ba1cb81665a09bbb97d0baf1a326b06d5a74cf10

    • Size

      292KB

    • MD5

      cea5368826643db52889abb3ca7a4304

    • SHA1

      d93379ff367aac3979c17a36f72c1bda9adb628c

    • SHA256

      65a9a594ab307fc520a599f3ba1cb81665a09bbb97d0baf1a326b06d5a74cf10

    • SHA512

      8873ef1717869a0b7a92f739e8576c69f72694ba62aaf23f34c55243080f2f74ec9ee2d04ad1931a204161001d8c24dbb2a428734d4ea7ccb4d0be2ca4b0a8cb

    • SSDEEP

      3072:pY9QSHF8Tkq1H8g03W0c6ZK5ZE+wBXwYDPmIYgpEK5p2zxy2AXur4oXkzxvE57kv:dSHU8g066zGCPYg+K5kzZOoixu+aGD0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks