General

  • Target

    15b4473894d45a08a50599ed8a98b87bfb1bc6c53d6839284fbb24a565576b8b

  • Size

    224KB

  • Sample

    241110-k1794sxjan

  • MD5

    539ebe468449d4b8a78c01fdf0ac3c54

  • SHA1

    6fbb6b0112730f0565f91a46bd734b35e4ea50be

  • SHA256

    15b4473894d45a08a50599ed8a98b87bfb1bc6c53d6839284fbb24a565576b8b

  • SHA512

    0271d7028a81d50ad48b63c42d0a770156db7b5f5891b7208f6457cf1b0735eb91602782bc05b0999b41198eb4c94a2845b65816722989a5eec7d196e6b09613

  • SSDEEP

    3072:/45c5fZJRwXNh3qBfvJITyJOr6wJ8RTszeHE/Jbd81K50C2rTlDIjdqKeD/k510:/4+VTIh3kW9rHsMeHE150lme

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      15b4473894d45a08a50599ed8a98b87bfb1bc6c53d6839284fbb24a565576b8b

    • Size

      224KB

    • MD5

      539ebe468449d4b8a78c01fdf0ac3c54

    • SHA1

      6fbb6b0112730f0565f91a46bd734b35e4ea50be

    • SHA256

      15b4473894d45a08a50599ed8a98b87bfb1bc6c53d6839284fbb24a565576b8b

    • SHA512

      0271d7028a81d50ad48b63c42d0a770156db7b5f5891b7208f6457cf1b0735eb91602782bc05b0999b41198eb4c94a2845b65816722989a5eec7d196e6b09613

    • SSDEEP

      3072:/45c5fZJRwXNh3qBfvJITyJOr6wJ8RTszeHE/Jbd81K50C2rTlDIjdqKeD/k510:/4+VTIh3kW9rHsMeHE150lme

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks