General

  • Target

    0e417be4c160387e5b0e9608d979be1a79f798c000baf9e85fda927b2ffab653

  • Size

    359KB

  • Sample

    241110-3jlnwszrcr

  • MD5

    295b8060a8a92caf88c76e7b758afe4e

  • SHA1

    35a3a49560b532220e2c1f785f3790a4af1da713

  • SHA256

    0e417be4c160387e5b0e9608d979be1a79f798c000baf9e85fda927b2ffab653

  • SHA512

    2d637aa1ae5d37a7054968a79edfa8ed0eafa6948d00e097f853f6133a7dbcf48e766723fc93997a81c443b3c9b90d0c60b1f8146f212a31000bddbabaf0f378

  • SSDEEP

    6144:X1wCiDvi1/EBFY7NHCV/mB8Kzx9e1kFkgKupq79FSgfk:X1wCiDa1/8YQV/a8Kzx96kGgtKM

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      0e417be4c160387e5b0e9608d979be1a79f798c000baf9e85fda927b2ffab653

    • Size

      359KB

    • MD5

      295b8060a8a92caf88c76e7b758afe4e

    • SHA1

      35a3a49560b532220e2c1f785f3790a4af1da713

    • SHA256

      0e417be4c160387e5b0e9608d979be1a79f798c000baf9e85fda927b2ffab653

    • SHA512

      2d637aa1ae5d37a7054968a79edfa8ed0eafa6948d00e097f853f6133a7dbcf48e766723fc93997a81c443b3c9b90d0c60b1f8146f212a31000bddbabaf0f378

    • SSDEEP

      6144:X1wCiDvi1/EBFY7NHCV/mB8Kzx9e1kFkgKupq79FSgfk:X1wCiDa1/8YQV/a8Kzx96kGgtKM

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks