General

  • Target

    3d2f34ea8305f25e824c809fbcfdda055070af719a1d0db44788b69c3a08d50f

  • Size

    361KB

  • Sample

    241110-rlfd4s1qcm

  • MD5

    b0aedd370d0c87371447d1e46ca126cc

  • SHA1

    221ac6744a1e13196f87655569ef6f1eb2c81b4d

  • SHA256

    3d2f34ea8305f25e824c809fbcfdda055070af719a1d0db44788b69c3a08d50f

  • SHA512

    79eb97bfc07dc520277d0fde9c1643e3246520ac0a6774f3057d83db4132634ec23651b187a5f3711dbc7df64f4beb9e0c29f4486e7bc4ac815b0f56bcb342ab

  • SSDEEP

    3072:XJBq3HUCjJajQt32lmy9se7V8xu0ay/MzvKZwxGIMKc6P9Jj3E8ykeyxDj6fKiLo:X/qksajQIlmC97QBuGtMj3ETPmb8oPs

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      3d2f34ea8305f25e824c809fbcfdda055070af719a1d0db44788b69c3a08d50f

    • Size

      361KB

    • MD5

      b0aedd370d0c87371447d1e46ca126cc

    • SHA1

      221ac6744a1e13196f87655569ef6f1eb2c81b4d

    • SHA256

      3d2f34ea8305f25e824c809fbcfdda055070af719a1d0db44788b69c3a08d50f

    • SHA512

      79eb97bfc07dc520277d0fde9c1643e3246520ac0a6774f3057d83db4132634ec23651b187a5f3711dbc7df64f4beb9e0c29f4486e7bc4ac815b0f56bcb342ab

    • SSDEEP

      3072:XJBq3HUCjJajQt32lmy9se7V8xu0ay/MzvKZwxGIMKc6P9Jj3E8ykeyxDj6fKiLo:X/qksajQIlmC97QBuGtMj3ETPmb8oPs

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks