General

  • Target

    a24cfd1243fd55f43765deea2db86c4a9fa99d25d4ee9a25ee34e6ad083591b1

  • Size

    291KB

  • Sample

    241109-v9fassxrdv

  • MD5

    290e705d85553aad965b645de1849ad5

  • SHA1

    965a033770c40cb88e301e55f991750dfa2c7674

  • SHA256

    a24cfd1243fd55f43765deea2db86c4a9fa99d25d4ee9a25ee34e6ad083591b1

  • SHA512

    8af9f6d2ae3e14d519a15f59e5eeb2a0fcb8012c1ded46ce563dbd3499e580cc208e99f788fa679167c467a4e8fde4cd8acd862a4b31fc4908c4d6527650f7bc

  • SSDEEP

    3072:BV75VLcdtSwcF/7NHs3we1RG4IWTK/Jt1gpfmwViXp0yCaMhTf53TOQsWvqmCIYj:hVLmSnFjNHqwmRG2Kxt6pPViayCZh7V

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      a24cfd1243fd55f43765deea2db86c4a9fa99d25d4ee9a25ee34e6ad083591b1

    • Size

      291KB

    • MD5

      290e705d85553aad965b645de1849ad5

    • SHA1

      965a033770c40cb88e301e55f991750dfa2c7674

    • SHA256

      a24cfd1243fd55f43765deea2db86c4a9fa99d25d4ee9a25ee34e6ad083591b1

    • SHA512

      8af9f6d2ae3e14d519a15f59e5eeb2a0fcb8012c1ded46ce563dbd3499e580cc208e99f788fa679167c467a4e8fde4cd8acd862a4b31fc4908c4d6527650f7bc

    • SSDEEP

      3072:BV75VLcdtSwcF/7NHs3we1RG4IWTK/Jt1gpfmwViXp0yCaMhTf53TOQsWvqmCIYj:hVLmSnFjNHqwmRG2Kxt6pPViayCZh7V

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks