General

  • Target

    5911aa56d423ae97ae4c23f762c989c3aff8ac81136023f80aa4e53678ab2c0c

  • Size

    359KB

  • Sample

    241108-z3f1zayqev

  • MD5

    4cf25d37084dfc50ba6d2777d24d1ec7

  • SHA1

    edbd4e22ad3e552dd0df0bdb068b55b5c78d6546

  • SHA256

    5911aa56d423ae97ae4c23f762c989c3aff8ac81136023f80aa4e53678ab2c0c

  • SHA512

    9244c02adf0b2a3fd37888fdc1bba712edc44182a7ed415082cbda8dedaaf9b3b0290f9e936a36933bdcba1fb757606c0572b3dc7449e7b25f21add7eded6418

  • SSDEEP

    6144:YZBE8HnA1/gBliIiD2IStq+OIAhkbqVc80d:YZBE8HA1/4ikIStYi+N0

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      5911aa56d423ae97ae4c23f762c989c3aff8ac81136023f80aa4e53678ab2c0c

    • Size

      359KB

    • MD5

      4cf25d37084dfc50ba6d2777d24d1ec7

    • SHA1

      edbd4e22ad3e552dd0df0bdb068b55b5c78d6546

    • SHA256

      5911aa56d423ae97ae4c23f762c989c3aff8ac81136023f80aa4e53678ab2c0c

    • SHA512

      9244c02adf0b2a3fd37888fdc1bba712edc44182a7ed415082cbda8dedaaf9b3b0290f9e936a36933bdcba1fb757606c0572b3dc7449e7b25f21add7eded6418

    • SSDEEP

      6144:YZBE8HnA1/gBliIiD2IStq+OIAhkbqVc80d:YZBE8HA1/4ikIStYi+N0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks