General

  • Target

    2aea126c7ef0085ec5c09c1ebecc950f94be3c04ba5eb384e4e47f28a68f5f6d

  • Size

    410KB

  • Sample

    241110-xmr27asglr

  • MD5

    d7f1e732f1cc699c59cc97aa9558d377

  • SHA1

    b84a5ef61f2b283b9924922bef52344577341c78

  • SHA256

    2aea126c7ef0085ec5c09c1ebecc950f94be3c04ba5eb384e4e47f28a68f5f6d

  • SHA512

    ae0c2ca13c715e670369d99814d6ccadfc8bd74c23959df1069c653f8a7386295b8f2105d803740c76cb80a6d9641802b33c91d77175d86822fe061f414b6851

  • SSDEEP

    6144:nngPyvF5GbNkH/yODBIMd4BsbLYAHWBEtuJ+lT6dsrqU4PXxQCadyxxp:ngPydiwBIMmBsov+O+lT6dsmU4zr

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      2aea126c7ef0085ec5c09c1ebecc950f94be3c04ba5eb384e4e47f28a68f5f6d

    • Size

      410KB

    • MD5

      d7f1e732f1cc699c59cc97aa9558d377

    • SHA1

      b84a5ef61f2b283b9924922bef52344577341c78

    • SHA256

      2aea126c7ef0085ec5c09c1ebecc950f94be3c04ba5eb384e4e47f28a68f5f6d

    • SHA512

      ae0c2ca13c715e670369d99814d6ccadfc8bd74c23959df1069c653f8a7386295b8f2105d803740c76cb80a6d9641802b33c91d77175d86822fe061f414b6851

    • SSDEEP

      6144:nngPyvF5GbNkH/yODBIMd4BsbLYAHWBEtuJ+lT6dsrqU4PXxQCadyxxp:ngPydiwBIMmBsov+O+lT6dsmU4zr

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks