General

  • Target

    56177e41eecb1fcd13a09c8a271bf7b4d61a03aa0a68b9ad7f8407fcf4290f5a

  • Size

    409KB

  • Sample

    241110-xmtk1swlhk

  • MD5

    efde9577ca9b86fec6b31f3302870651

  • SHA1

    e427075680cd5600d8545a3422aa1edba148f4bf

  • SHA256

    56177e41eecb1fcd13a09c8a271bf7b4d61a03aa0a68b9ad7f8407fcf4290f5a

  • SHA512

    3fbde694ebd36350b3325d8510ad22860df7a5d77c6dd9dd771b12f3187546f7954ec20702198f51287fa549c07d72c0e34ec18be731a9fe2656923c988ba773

  • SSDEEP

    6144:JMg8qLo6HLNjEIX5MIhMJrliAod+a+LFrklgrdtny8iJWjOXJLIxxmi:JT8YhLNJVhMJIt2Zrklgrdty8iFXK/

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      56177e41eecb1fcd13a09c8a271bf7b4d61a03aa0a68b9ad7f8407fcf4290f5a

    • Size

      409KB

    • MD5

      efde9577ca9b86fec6b31f3302870651

    • SHA1

      e427075680cd5600d8545a3422aa1edba148f4bf

    • SHA256

      56177e41eecb1fcd13a09c8a271bf7b4d61a03aa0a68b9ad7f8407fcf4290f5a

    • SHA512

      3fbde694ebd36350b3325d8510ad22860df7a5d77c6dd9dd771b12f3187546f7954ec20702198f51287fa549c07d72c0e34ec18be731a9fe2656923c988ba773

    • SSDEEP

      6144:JMg8qLo6HLNjEIX5MIhMJrliAod+a+LFrklgrdtny8iJWjOXJLIxxmi:JT8YhLNJVhMJIt2Zrklgrdty8iFXK/

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks