General

  • Target

    c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02

  • Size

    224KB

  • Sample

    241110-tfcgdazjgw

  • MD5

    5fad9c7e1fcfe77e79ea61beb29337ae

  • SHA1

    5277e4bc7d14af81ef584337b2cbf2a93dc88d4d

  • SHA256

    c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02

  • SHA512

    6c3d9abea7be29ee5b315c4fe5a82b66302799f76c78640b1c8f76744c5eb54b2f7364ed23c47fd0f0670b4ded3f5d07c05603bad0dc827c6b6461aaf28c42ca

  • SSDEEP

    3072:9zRGdzonEWbxTH/fBawdaUoD57N20Xk1YwGzGkA0tl8PcHMSh6k5jqmBlUEe:9zcSEUxTffBxaFtXkNGzGSHMmE+K

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02

    • Size

      224KB

    • MD5

      5fad9c7e1fcfe77e79ea61beb29337ae

    • SHA1

      5277e4bc7d14af81ef584337b2cbf2a93dc88d4d

    • SHA256

      c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02

    • SHA512

      6c3d9abea7be29ee5b315c4fe5a82b66302799f76c78640b1c8f76744c5eb54b2f7364ed23c47fd0f0670b4ded3f5d07c05603bad0dc827c6b6461aaf28c42ca

    • SSDEEP

      3072:9zRGdzonEWbxTH/fBawdaUoD57N20Xk1YwGzGkA0tl8PcHMSh6k5jqmBlUEe:9zcSEUxTffBxaFtXkNGzGSHMmE+K

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks