General

  • Target

    bd684d65ad2b8a82ed686c4f4f9282add5f05e13a1210ad84c888f19b4c167a5

  • Size

    390KB

  • Sample

    241110-t6rnzs1amn

  • MD5

    8ef6ce9352f7bd164d4a71fa0594dbfe

  • SHA1

    88145f46b62ffc9c0ce641c1fc39224462f2aade

  • SHA256

    bd684d65ad2b8a82ed686c4f4f9282add5f05e13a1210ad84c888f19b4c167a5

  • SHA512

    b146d049c2b61d93c35781b75b63bcf10d46e7bf710fffb9521dab50dd661e2699829eda741ead1b951f11922be9d0e1c968f04bd573b34f511195659305fdff

  • SSDEEP

    6144:dKFLRNxLsc0yb7BKrafpBVMFrt1NON/juAUWQAL6MCOhxxFeTr/ekI:MFLxwc0y3jSROxaAL6+zxF6L

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      bd684d65ad2b8a82ed686c4f4f9282add5f05e13a1210ad84c888f19b4c167a5

    • Size

      390KB

    • MD5

      8ef6ce9352f7bd164d4a71fa0594dbfe

    • SHA1

      88145f46b62ffc9c0ce641c1fc39224462f2aade

    • SHA256

      bd684d65ad2b8a82ed686c4f4f9282add5f05e13a1210ad84c888f19b4c167a5

    • SHA512

      b146d049c2b61d93c35781b75b63bcf10d46e7bf710fffb9521dab50dd661e2699829eda741ead1b951f11922be9d0e1c968f04bd573b34f511195659305fdff

    • SSDEEP

      6144:dKFLRNxLsc0yb7BKrafpBVMFrt1NON/juAUWQAL6MCOhxxFeTr/ekI:MFLxwc0y3jSROxaAL6+zxF6L

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks