General

  • Target

    2256ac967b54f1c0618212705a6b3ee70ba64a23e230b3c6c3e970ea6a04942d

  • Size

    224KB

  • Sample

    241110-f38anstlen

  • MD5

    d8fabd81ff46461a594a006fbd38eb13

  • SHA1

    0a0afc7c58834a276f9ea53da4bdff88d8fb9806

  • SHA256

    2256ac967b54f1c0618212705a6b3ee70ba64a23e230b3c6c3e970ea6a04942d

  • SHA512

    d4e84cf21680a6b19ae421bb774c484456d7bb8f92e28646741915f1753c6050c09d55e085b1aaa09601ca6e2c470503721b2490322b3c0c244287263535ec86

  • SSDEEP

    3072:QHOt/utpqsigNfA7pgfd8LO2MRasvfTxTqNlqss0f2qChBIEk579EUHZ:QHcY4hgK+UsHTYloA27G9

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      2256ac967b54f1c0618212705a6b3ee70ba64a23e230b3c6c3e970ea6a04942d

    • Size

      224KB

    • MD5

      d8fabd81ff46461a594a006fbd38eb13

    • SHA1

      0a0afc7c58834a276f9ea53da4bdff88d8fb9806

    • SHA256

      2256ac967b54f1c0618212705a6b3ee70ba64a23e230b3c6c3e970ea6a04942d

    • SHA512

      d4e84cf21680a6b19ae421bb774c484456d7bb8f92e28646741915f1753c6050c09d55e085b1aaa09601ca6e2c470503721b2490322b3c0c244287263535ec86

    • SSDEEP

      3072:QHOt/utpqsigNfA7pgfd8LO2MRasvfTxTqNlqss0f2qChBIEk579EUHZ:QHcY4hgK+UsHTYloA27G9

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks