General

  • Target

    88a5cf75299e06f2992c6cf7bbfe346adf33b7ee3fbf3e97e4b61447378c75c7

  • Size

    250KB

  • Sample

    241109-e5s34axjes

  • MD5

    9ff48f306f73eaaed1f49b96be4ceeed

  • SHA1

    9552ab484e9f8869fc8830b54153b12ec3dcc54c

  • SHA256

    88a5cf75299e06f2992c6cf7bbfe346adf33b7ee3fbf3e97e4b61447378c75c7

  • SHA512

    2063622383038ebf52a7854cb0bd4829d2ba1fd4058ba874ff5571ff7fe3b304ed01de2ddea8281460aaf8e4c65cf6b3bf28d8ed228ff4451bc01d2205d67962

  • SSDEEP

    3072:EY3Cd9RH9PP6Am7/Bg3vcVi2jLcD5NfbIm6EZmbjTEfFXvJ5njkZ7Znsn:kHw7/B+vcs2y5FbHZAjTIFXrjkZNu

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      88a5cf75299e06f2992c6cf7bbfe346adf33b7ee3fbf3e97e4b61447378c75c7

    • Size

      250KB

    • MD5

      9ff48f306f73eaaed1f49b96be4ceeed

    • SHA1

      9552ab484e9f8869fc8830b54153b12ec3dcc54c

    • SHA256

      88a5cf75299e06f2992c6cf7bbfe346adf33b7ee3fbf3e97e4b61447378c75c7

    • SHA512

      2063622383038ebf52a7854cb0bd4829d2ba1fd4058ba874ff5571ff7fe3b304ed01de2ddea8281460aaf8e4c65cf6b3bf28d8ed228ff4451bc01d2205d67962

    • SSDEEP

      3072:EY3Cd9RH9PP6Am7/Bg3vcVi2jLcD5NfbIm6EZmbjTEfFXvJ5njkZ7Znsn:kHw7/B+vcs2y5FbHZAjTIFXrjkZNu

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks