General

  • Target

    cd5a846b672a53ae4f2d37734751ed67ab2072999148b1138f78f51fb2f4a0e9

  • Size

    240KB

  • Sample

    241109-pmah5sxkhm

  • MD5

    dd166cd237cb4231928fcdb1024f4e22

  • SHA1

    8c698977acb535ceed30435eb951ac71d98e7f1c

  • SHA256

    cd5a846b672a53ae4f2d37734751ed67ab2072999148b1138f78f51fb2f4a0e9

  • SHA512

    bef491c690e1e40341600bc47b880743f9ca9bb11568153fcd757f89a9c07e606677408dfe21b853a6d3770ee82ece4abeeda3e013db9d061b808a11fd2d13df

  • SSDEEP

    6144:M1Vul/vjdKVvmLSZ3xE7F4jBkGk0NVmO:KVuSJDEF4NkGFf

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      cd5a846b672a53ae4f2d37734751ed67ab2072999148b1138f78f51fb2f4a0e9

    • Size

      240KB

    • MD5

      dd166cd237cb4231928fcdb1024f4e22

    • SHA1

      8c698977acb535ceed30435eb951ac71d98e7f1c

    • SHA256

      cd5a846b672a53ae4f2d37734751ed67ab2072999148b1138f78f51fb2f4a0e9

    • SHA512

      bef491c690e1e40341600bc47b880743f9ca9bb11568153fcd757f89a9c07e606677408dfe21b853a6d3770ee82ece4abeeda3e013db9d061b808a11fd2d13df

    • SSDEEP

      6144:M1Vul/vjdKVvmLSZ3xE7F4jBkGk0NVmO:KVuSJDEF4NkGFf

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks