General

  • Target

    24e018dccbc696e50abdda70ef7d114fdfb8c41535b36cc2a4bb2032a1350d0c

  • Size

    403KB

  • Sample

    241110-b462sawgrl

  • MD5

    208f8da362c2da4a290869b99f2c9db2

  • SHA1

    50a77ac194ee0e4bbe11e1e6f49b20269db8e02d

  • SHA256

    24e018dccbc696e50abdda70ef7d114fdfb8c41535b36cc2a4bb2032a1350d0c

  • SHA512

    493a1447754080b2b499c60eb71ba4e36fb0277a53a0848f59518b46f7e9de46cd401a0baec8d1c708588eecbc66ff9204034d3062c4246b66861f45ab7e1a85

  • SSDEEP

    6144:LQRwiwQRTbqL2JL5HIvDltsXol6uuwYuq8ktnHUw9qJL6Z/rHOOhxxdeTr/ekI:LNqJL5HIvDltsXoXuaUU9L6xvzxd6L

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.20:13441

Targets

    • Target

      24e018dccbc696e50abdda70ef7d114fdfb8c41535b36cc2a4bb2032a1350d0c

    • Size

      403KB

    • MD5

      208f8da362c2da4a290869b99f2c9db2

    • SHA1

      50a77ac194ee0e4bbe11e1e6f49b20269db8e02d

    • SHA256

      24e018dccbc696e50abdda70ef7d114fdfb8c41535b36cc2a4bb2032a1350d0c

    • SHA512

      493a1447754080b2b499c60eb71ba4e36fb0277a53a0848f59518b46f7e9de46cd401a0baec8d1c708588eecbc66ff9204034d3062c4246b66861f45ab7e1a85

    • SSDEEP

      6144:LQRwiwQRTbqL2JL5HIvDltsXol6uuwYuq8ktnHUw9qJL6Z/rHOOhxxdeTr/ekI:LNqJL5HIvDltsXoXuaUU9L6xvzxd6L

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks