General

  • Target

    46971537f058e5e4c712d0d2c8670d7cd993204330939498b5d37931e2859172

  • Size

    412KB

  • Sample

    241111-bqp64szcng

  • MD5

    68160b0a200b600df9a91f56d45979e3

  • SHA1

    04ee7960c708a1cc6320d3ec83a2801aadf89c44

  • SHA256

    46971537f058e5e4c712d0d2c8670d7cd993204330939498b5d37931e2859172

  • SHA512

    09cf38aacaf6f877d7ce6871d58c9cb4998d37f81ee436360fbf080cd14ee2296f41fe6d7f2b0e6b2401883a3de69dfa73f04aea70726f5236d38920087b4e85

  • SSDEEP

    12288:KEUwNKyfbZJgudZVC6E+uUWedV594MGJg:f1KwJgNPUr59neg

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      46971537f058e5e4c712d0d2c8670d7cd993204330939498b5d37931e2859172

    • Size

      412KB

    • MD5

      68160b0a200b600df9a91f56d45979e3

    • SHA1

      04ee7960c708a1cc6320d3ec83a2801aadf89c44

    • SHA256

      46971537f058e5e4c712d0d2c8670d7cd993204330939498b5d37931e2859172

    • SHA512

      09cf38aacaf6f877d7ce6871d58c9cb4998d37f81ee436360fbf080cd14ee2296f41fe6d7f2b0e6b2401883a3de69dfa73f04aea70726f5236d38920087b4e85

    • SSDEEP

      12288:KEUwNKyfbZJgudZVC6E+uUWedV594MGJg:f1KwJgNPUr59neg

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks