General

  • Target

    7811eb365295fade6ee1e6829518eaa3be95bbff91e7b9f803889be0f176ac08

  • Size

    409KB

  • Sample

    241109-fpdh5sybjr

  • MD5

    6fa2b4e57b0055fbe2b3657fb9288ba2

  • SHA1

    cd312727ac7394f403af6b226f07ed8855838fd5

  • SHA256

    7811eb365295fade6ee1e6829518eaa3be95bbff91e7b9f803889be0f176ac08

  • SHA512

    0a62b3ff88eb575218ce1e24373a3cca5cfdd0630d8fb6a93aec776cbfd493f32cbc222ce5eaa4fd6696c1a221fd35f3600728ba5afe919e88bb72b3b931bc06

  • SSDEEP

    12288:vvFWvnbbfKukQ6n/GVINUY2H8uBoymF1mPV:vNWvnbLKukQgO84oyMy

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      7811eb365295fade6ee1e6829518eaa3be95bbff91e7b9f803889be0f176ac08

    • Size

      409KB

    • MD5

      6fa2b4e57b0055fbe2b3657fb9288ba2

    • SHA1

      cd312727ac7394f403af6b226f07ed8855838fd5

    • SHA256

      7811eb365295fade6ee1e6829518eaa3be95bbff91e7b9f803889be0f176ac08

    • SHA512

      0a62b3ff88eb575218ce1e24373a3cca5cfdd0630d8fb6a93aec776cbfd493f32cbc222ce5eaa4fd6696c1a221fd35f3600728ba5afe919e88bb72b3b931bc06

    • SSDEEP

      12288:vvFWvnbbfKukQ6n/GVINUY2H8uBoymF1mPV:vNWvnbLKukQgO84oyMy

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks