General

  • Target

    0848841d0bfe7f28776b0e511f8c27a278d7f7b07a31ba751b7e129c26dc70fb

  • Size

    364KB

  • Sample

    241109-zn8gnssckn

  • MD5

    4fba4039d291b793bc444bac773a4bb8

  • SHA1

    9e50077c13c52428eacebda0a1764b97acc24f1c

  • SHA256

    0848841d0bfe7f28776b0e511f8c27a278d7f7b07a31ba751b7e129c26dc70fb

  • SHA512

    70039a5908f4b0c7b9f38071749762006c845a56c2f98befd92969c69fd9ab40903463def47d613ee7876997715dadf9858e5183f4c49be0169fe2b20b24ac4d

  • SSDEEP

    6144:u4IZQ5J3dcgSQqrkkPHx2J6P6e5vdYLV8Z4LoqX7tNfVXVHQLIiu8cfo0/pW:zIZ2J3xWVPx5RbwZGEX8cA0/M

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      0848841d0bfe7f28776b0e511f8c27a278d7f7b07a31ba751b7e129c26dc70fb

    • Size

      364KB

    • MD5

      4fba4039d291b793bc444bac773a4bb8

    • SHA1

      9e50077c13c52428eacebda0a1764b97acc24f1c

    • SHA256

      0848841d0bfe7f28776b0e511f8c27a278d7f7b07a31ba751b7e129c26dc70fb

    • SHA512

      70039a5908f4b0c7b9f38071749762006c845a56c2f98befd92969c69fd9ab40903463def47d613ee7876997715dadf9858e5183f4c49be0169fe2b20b24ac4d

    • SSDEEP

      6144:u4IZQ5J3dcgSQqrkkPHx2J6P6e5vdYLV8Z4LoqX7tNfVXVHQLIiu8cfo0/pW:zIZ2J3xWVPx5RbwZGEX8cA0/M

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks