General

  • Target

    8ce845bb7f5ce8dd6dcc83df87c54d15136e72ae5f252e9c23d67d10d8656be2

  • Size

    253KB

  • Sample

    241108-bplsassarj

  • MD5

    b6a9885bf670ce4c771176ed9311c67a

  • SHA1

    137f0d5453c126e1d71bb8faf7aa01f00cd26f5d

  • SHA256

    8ce845bb7f5ce8dd6dcc83df87c54d15136e72ae5f252e9c23d67d10d8656be2

  • SHA512

    a68c2813c7a96f9226e773328b406a16b92d1c4f40c3caefdc90e8d10fa5bb93faff4edecc8b35ae90c25c410d106984eee3d05f242d57991dbb4a8280e03a8a

  • SSDEEP

    3072:rEfA6SwhhZzQIAP1HgshYpheYmTwztwt1q0aG61Pl+HoyxD6Y6I5hkKg4YS9H6ds:rKzZ0J1Xh4EZLaTCpxD6YhbYEad

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.20:13441

Targets

    • Target

      8ce845bb7f5ce8dd6dcc83df87c54d15136e72ae5f252e9c23d67d10d8656be2

    • Size

      253KB

    • MD5

      b6a9885bf670ce4c771176ed9311c67a

    • SHA1

      137f0d5453c126e1d71bb8faf7aa01f00cd26f5d

    • SHA256

      8ce845bb7f5ce8dd6dcc83df87c54d15136e72ae5f252e9c23d67d10d8656be2

    • SHA512

      a68c2813c7a96f9226e773328b406a16b92d1c4f40c3caefdc90e8d10fa5bb93faff4edecc8b35ae90c25c410d106984eee3d05f242d57991dbb4a8280e03a8a

    • SSDEEP

      3072:rEfA6SwhhZzQIAP1HgshYpheYmTwztwt1q0aG61Pl+HoyxD6Y6I5hkKg4YS9H6ds:rKzZ0J1Xh4EZLaTCpxD6YhbYEad

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks