General

  • Target

    5509c959d0376f50d626875cbd13487714655e186bfef676101a3770f9bc0cac

  • Size

    409KB

  • Sample

    241110-lms4pstgqq

  • MD5

    1f69f6f464aba2ea9c2d4b55c9c70cdb

  • SHA1

    1ee41c9f1727f791fdfb0d7caf5292f7cd26ffed

  • SHA256

    5509c959d0376f50d626875cbd13487714655e186bfef676101a3770f9bc0cac

  • SHA512

    6f9cd56c78a8423306ed6b268259e29ec3ac8eabe00c9fd2c6f3f6c5b140a12d847a1dffe703b670532f1fc5984c509a4ff7fbe753312b16c1e9a2478b89ebf7

  • SSDEEP

    12288:ikq3jntfWhYMbZSKbnwsIbGauBkoUXghdK:i53jndyDgKWLuqoUQ+

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      5509c959d0376f50d626875cbd13487714655e186bfef676101a3770f9bc0cac

    • Size

      409KB

    • MD5

      1f69f6f464aba2ea9c2d4b55c9c70cdb

    • SHA1

      1ee41c9f1727f791fdfb0d7caf5292f7cd26ffed

    • SHA256

      5509c959d0376f50d626875cbd13487714655e186bfef676101a3770f9bc0cac

    • SHA512

      6f9cd56c78a8423306ed6b268259e29ec3ac8eabe00c9fd2c6f3f6c5b140a12d847a1dffe703b670532f1fc5984c509a4ff7fbe753312b16c1e9a2478b89ebf7

    • SSDEEP

      12288:ikq3jntfWhYMbZSKbnwsIbGauBkoUXghdK:i53jndyDgKWLuqoUQ+

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks