General

  • Target

    1414c9b9a80c4ac098aea3c86ed9bc7d89af5436f89062741a2073f9ac0581f9

  • Size

    413KB

  • Sample

    241110-pn7v2awmby

  • MD5

    17b97717e2cbcc0a326876e4ff3c3dfb

  • SHA1

    1e4e28f777a467de783e7eec0becd33de6e5f4d7

  • SHA256

    1414c9b9a80c4ac098aea3c86ed9bc7d89af5436f89062741a2073f9ac0581f9

  • SHA512

    7fd0f691e4969d5482a9ef6fc092c61db10104c871c066591b4356a71e6116c105108072d4af22015c98aaad72d7c89fded60dc88cef97c7bfcf09b2cf4c92f8

  • SSDEEP

    12288:Sd30EPYtvACYkMZCu9I/mp+N1dCfTnzoyJd:eNgtoCJ9s+cfTzx

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      1414c9b9a80c4ac098aea3c86ed9bc7d89af5436f89062741a2073f9ac0581f9

    • Size

      413KB

    • MD5

      17b97717e2cbcc0a326876e4ff3c3dfb

    • SHA1

      1e4e28f777a467de783e7eec0becd33de6e5f4d7

    • SHA256

      1414c9b9a80c4ac098aea3c86ed9bc7d89af5436f89062741a2073f9ac0581f9

    • SHA512

      7fd0f691e4969d5482a9ef6fc092c61db10104c871c066591b4356a71e6116c105108072d4af22015c98aaad72d7c89fded60dc88cef97c7bfcf09b2cf4c92f8

    • SSDEEP

      12288:Sd30EPYtvACYkMZCu9I/mp+N1dCfTnzoyJd:eNgtoCJ9s+cfTzx

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks