General

  • Target

    65709b39aff5115f253a3029a0c1e52d8dc0c1e8ee64784c319bec27e8da44fb

  • Size

    360KB

  • Sample

    241110-d4blzs1rdr

  • MD5

    b79c37a4e034425894783a86ae1dd5be

  • SHA1

    fe5c5c6a3b0f7875453e9c783879d0c9bd9d8fef

  • SHA256

    65709b39aff5115f253a3029a0c1e52d8dc0c1e8ee64784c319bec27e8da44fb

  • SHA512

    a3512e18762550f3d2902a1d5e6ba6fad423ffc3a4a2c0776f824147d78e2f0cd658f85fe61fbc0d03d9c83a7f42c192b47a914d7e9f0b8451b1f436062e3dfe

  • SSDEEP

    6144:0/kCmfoR1//Bk4oaWkQf5wVs6Uk9owu9t5RkNJqZwubreGX8X:0/kCmfM1/m4EwVsI9o5t5YkZBG

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      65709b39aff5115f253a3029a0c1e52d8dc0c1e8ee64784c319bec27e8da44fb

    • Size

      360KB

    • MD5

      b79c37a4e034425894783a86ae1dd5be

    • SHA1

      fe5c5c6a3b0f7875453e9c783879d0c9bd9d8fef

    • SHA256

      65709b39aff5115f253a3029a0c1e52d8dc0c1e8ee64784c319bec27e8da44fb

    • SHA512

      a3512e18762550f3d2902a1d5e6ba6fad423ffc3a4a2c0776f824147d78e2f0cd658f85fe61fbc0d03d9c83a7f42c192b47a914d7e9f0b8451b1f436062e3dfe

    • SSDEEP

      6144:0/kCmfoR1//Bk4oaWkQf5wVs6Uk9owu9t5RkNJqZwubreGX8X:0/kCmfM1/m4EwVsI9o5t5YkZBG

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks