General

  • Target

    82ab9557940f185192dfdc6d8261edd3e9dd3def300363c376d93e291f4cf83a

  • Size

    401KB

  • Sample

    241110-entnasyhqr

  • MD5

    c38bd097566477c5a94a3af0ec7adc29

  • SHA1

    fb5dffb41e290dd6a5110ca0e40ab290d35011b5

  • SHA256

    82ab9557940f185192dfdc6d8261edd3e9dd3def300363c376d93e291f4cf83a

  • SHA512

    8808d8df0a4b3de0c7adc8fc64d6ac9f6d02423da9e40f60a7260d430bdf26d6a8e38bce585db75e7711142f94b2ec752e20de9f7b50fe3142c42bd7021b0a33

  • SSDEEP

    6144:vWzNin9GgZ9rt0lJCd1f2Fp7dEngZD0fUxhwmny4CFeu:iNoP9R0lUf2T7dEuDOUxXncs

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.20:13441

Targets

    • Target

      82ab9557940f185192dfdc6d8261edd3e9dd3def300363c376d93e291f4cf83a

    • Size

      401KB

    • MD5

      c38bd097566477c5a94a3af0ec7adc29

    • SHA1

      fb5dffb41e290dd6a5110ca0e40ab290d35011b5

    • SHA256

      82ab9557940f185192dfdc6d8261edd3e9dd3def300363c376d93e291f4cf83a

    • SHA512

      8808d8df0a4b3de0c7adc8fc64d6ac9f6d02423da9e40f60a7260d430bdf26d6a8e38bce585db75e7711142f94b2ec752e20de9f7b50fe3142c42bd7021b0a33

    • SSDEEP

      6144:vWzNin9GgZ9rt0lJCd1f2Fp7dEngZD0fUxhwmny4CFeu:iNoP9R0lUf2T7dEuDOUxXncs

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks