General

  • Target

    c5ef3d1430ef30550bbed98aa06f07d7399cdad15d1bb3903794fdc6b24a2ba7

  • Size

    224KB

  • Sample

    241108-l2qbcssqen

  • MD5

    d83a620a6e150564683248485c541c5c

  • SHA1

    aa1ba2a93f7b742fcf1ea8ad9320638751698c10

  • SHA256

    c5ef3d1430ef30550bbed98aa06f07d7399cdad15d1bb3903794fdc6b24a2ba7

  • SHA512

    a0acde94a0e93bdd90f17b40ebe567e65897cb4013c65549452842f2f636f773536c7aed7a8ccced0f3547685d24f3c269fbcd9a030f417921b882c35583316b

  • SSDEEP

    3072:D6oEE61ryvWrKgrlQyeQsKVZAqvRyI3uEoGOYWZRlrdJZK/K0J82QuwQk5cijTvZ:D6o+y5grlQIf+B9YgZKCDYiH

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      c5ef3d1430ef30550bbed98aa06f07d7399cdad15d1bb3903794fdc6b24a2ba7

    • Size

      224KB

    • MD5

      d83a620a6e150564683248485c541c5c

    • SHA1

      aa1ba2a93f7b742fcf1ea8ad9320638751698c10

    • SHA256

      c5ef3d1430ef30550bbed98aa06f07d7399cdad15d1bb3903794fdc6b24a2ba7

    • SHA512

      a0acde94a0e93bdd90f17b40ebe567e65897cb4013c65549452842f2f636f773536c7aed7a8ccced0f3547685d24f3c269fbcd9a030f417921b882c35583316b

    • SSDEEP

      3072:D6oEE61ryvWrKgrlQyeQsKVZAqvRyI3uEoGOYWZRlrdJZK/K0J82QuwQk5cijTvZ:D6o+y5grlQIf+B9YgZKCDYiH

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks