General

  • Target

    59ebcf28fec70d6adefe29ac6b89e044a3d1d504102f98c96fea81eb037e0d3d

  • Size

    361KB

  • Sample

    241108-m9a23s1fkp

  • MD5

    9ac175b6257a0813d4a4684778c90c8c

  • SHA1

    8419ca5d3046361ac76eb9a92a343122302613ad

  • SHA256

    59ebcf28fec70d6adefe29ac6b89e044a3d1d504102f98c96fea81eb037e0d3d

  • SHA512

    a64078abe3841cf07f0593a01dd096f4d15024a8f933c405ee3f677b2d6812fcc0a2597e27998c3c16466fc0ef90df686ee34686450af284073c7d0272ce8d16

  • SSDEEP

    6144:wVvHc6djoVlab90nWmxNUfnIcUVwY6fCtZUmwZHe+Ajb9eC+f:wVvHLjoVllnQfzVwwZHKpe

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.20:13441

Targets

    • Target

      59ebcf28fec70d6adefe29ac6b89e044a3d1d504102f98c96fea81eb037e0d3d

    • Size

      361KB

    • MD5

      9ac175b6257a0813d4a4684778c90c8c

    • SHA1

      8419ca5d3046361ac76eb9a92a343122302613ad

    • SHA256

      59ebcf28fec70d6adefe29ac6b89e044a3d1d504102f98c96fea81eb037e0d3d

    • SHA512

      a64078abe3841cf07f0593a01dd096f4d15024a8f933c405ee3f677b2d6812fcc0a2597e27998c3c16466fc0ef90df686ee34686450af284073c7d0272ce8d16

    • SSDEEP

      6144:wVvHc6djoVlab90nWmxNUfnIcUVwY6fCtZUmwZHe+Ajb9eC+f:wVvHLjoVllnQfzVwwZHKpe

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks