General

  • Target

    280f3075c68429371c11e9d8f133bcf18090125f8d10903ac28106c2f718d38b

  • Size

    239KB

  • Sample

    241110-agg9gaxrcl

  • MD5

    ebf85cd67a544068a29537a612dfe596

  • SHA1

    b444ac59e32d1c381169c014d8c24635e3965643

  • SHA256

    280f3075c68429371c11e9d8f133bcf18090125f8d10903ac28106c2f718d38b

  • SHA512

    7f99eb6e2a018f3f3db124e36729e37d2ccc27294fa2ff2eeb06bb8b35f56c06e0dbf646ea3e10a045d253261bbd8f72b08507c58953c1984219cd0be6ef107c

  • SSDEEP

    3072:qBPv9iFPp+pojjuFSSa+AM9vgb0yo6IaTVVbmkKi/QfB8c7d9njknT5Un0O:q1uB4K4TvDNgwyotIbtKi/QZQjO

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.20:13441

Targets

    • Target

      280f3075c68429371c11e9d8f133bcf18090125f8d10903ac28106c2f718d38b

    • Size

      239KB

    • MD5

      ebf85cd67a544068a29537a612dfe596

    • SHA1

      b444ac59e32d1c381169c014d8c24635e3965643

    • SHA256

      280f3075c68429371c11e9d8f133bcf18090125f8d10903ac28106c2f718d38b

    • SHA512

      7f99eb6e2a018f3f3db124e36729e37d2ccc27294fa2ff2eeb06bb8b35f56c06e0dbf646ea3e10a045d253261bbd8f72b08507c58953c1984219cd0be6ef107c

    • SSDEEP

      3072:qBPv9iFPp+pojjuFSSa+AM9vgb0yo6IaTVVbmkKi/QfB8c7d9njknT5Un0O:q1uB4K4TvDNgwyotIbtKi/QZQjO

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks