General

  • Target

    3e764bed6fa6b74fb6859af106a65b939979fe3d3fd0dccc5e59d4a560be378b

  • Size

    313KB

  • Sample

    241110-nvmb8swcqp

  • MD5

    92aae58889bd6f089348b75ad9e628b9

  • SHA1

    e12d323d9d9e2032773641c88c3fff4015c2c95a

  • SHA256

    3e764bed6fa6b74fb6859af106a65b939979fe3d3fd0dccc5e59d4a560be378b

  • SHA512

    271b0cf8ab32aec98cee46b9827c7a37f6e41d5b0c708c8416e80ff5fb84e416e585421d83ddcebdd6c367a0c15046a51fa41847143b2c17df9e0fe7c2fa7595

  • SSDEEP

    6144:lOZQNt0IoE/r+SmC3kNBt1SeP9WQKTpuWrOCIL:EZxE/r+SKNBzSU9WTphrOH

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      3e764bed6fa6b74fb6859af106a65b939979fe3d3fd0dccc5e59d4a560be378b

    • Size

      313KB

    • MD5

      92aae58889bd6f089348b75ad9e628b9

    • SHA1

      e12d323d9d9e2032773641c88c3fff4015c2c95a

    • SHA256

      3e764bed6fa6b74fb6859af106a65b939979fe3d3fd0dccc5e59d4a560be378b

    • SHA512

      271b0cf8ab32aec98cee46b9827c7a37f6e41d5b0c708c8416e80ff5fb84e416e585421d83ddcebdd6c367a0c15046a51fa41847143b2c17df9e0fe7c2fa7595

    • SSDEEP

      6144:lOZQNt0IoE/r+SmC3kNBt1SeP9WQKTpuWrOCIL:EZxE/r+SKNBzSU9WTphrOH

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks