General

  • Target

    4f03baedc776e37b2ed54fe16bc24a3cc6c79cacb8f154924678d157b9aaf906

  • Size

    410KB

  • Sample

    241108-b4grws1phw

  • MD5

    e299a00b6e67297adde66e2139efd924

  • SHA1

    0fcc250d6bb7ff1089f4a6cf0a761b88d741903d

  • SHA256

    4f03baedc776e37b2ed54fe16bc24a3cc6c79cacb8f154924678d157b9aaf906

  • SHA512

    bfed8bd1cda815d9bbb0e9e94ffcd3c43cba35b99bfb4de72bf217a2fd9cad06e63dd54a208e09b8091f7a1c282d918d69c16defdc45f4758d8a9bf5fc6a09cf

  • SSDEEP

    12288:jG6Q4+fGJcLaKXkVcEbRGhlT6d4md96a:j7MCnRol7md95

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      4f03baedc776e37b2ed54fe16bc24a3cc6c79cacb8f154924678d157b9aaf906

    • Size

      410KB

    • MD5

      e299a00b6e67297adde66e2139efd924

    • SHA1

      0fcc250d6bb7ff1089f4a6cf0a761b88d741903d

    • SHA256

      4f03baedc776e37b2ed54fe16bc24a3cc6c79cacb8f154924678d157b9aaf906

    • SHA512

      bfed8bd1cda815d9bbb0e9e94ffcd3c43cba35b99bfb4de72bf217a2fd9cad06e63dd54a208e09b8091f7a1c282d918d69c16defdc45f4758d8a9bf5fc6a09cf

    • SSDEEP

      12288:jG6Q4+fGJcLaKXkVcEbRGhlT6d4md96a:j7MCnRol7md95

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks