General

  • Target

    a0f227e1e23efdb8174a8dcd6aeba6aaf1aa51b2c4a8d327b32af3d433d35407

  • Size

    410KB

  • Sample

    241110-rnxq6sycjl

  • MD5

    a073b7a2e6a318476d56fc48075bbaa4

  • SHA1

    f56f0e6067a4b4c9925345564863b9f706cdb9b1

  • SHA256

    a0f227e1e23efdb8174a8dcd6aeba6aaf1aa51b2c4a8d327b32af3d433d35407

  • SHA512

    b67a7564851a9445bfc8ce84baeb5777c5b85cb61af59503ab2e4417838b1efa7dba2f74c20527d8b115e66977332f6d18549f095781c0ca5c4c494ef13d46b0

  • SSDEEP

    12288:5QNkqn4sg9YZrHemZa9c4W3lnKdazurmY:58kqbgK2WlZzurr

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      a0f227e1e23efdb8174a8dcd6aeba6aaf1aa51b2c4a8d327b32af3d433d35407

    • Size

      410KB

    • MD5

      a073b7a2e6a318476d56fc48075bbaa4

    • SHA1

      f56f0e6067a4b4c9925345564863b9f706cdb9b1

    • SHA256

      a0f227e1e23efdb8174a8dcd6aeba6aaf1aa51b2c4a8d327b32af3d433d35407

    • SHA512

      b67a7564851a9445bfc8ce84baeb5777c5b85cb61af59503ab2e4417838b1efa7dba2f74c20527d8b115e66977332f6d18549f095781c0ca5c4c494ef13d46b0

    • SSDEEP

      12288:5QNkqn4sg9YZrHemZa9c4W3lnKdazurmY:58kqbgK2WlZzurr

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks