General

  • Target

    a245263269ea23b72af459e57d9a0cd52d3a45c9d3f26b147690a1f7313bcd2d

  • Size

    224KB

  • Sample

    241111-cpsfhszfqr

  • MD5

    ef146a56f4782ae2662ecc10ffae3e9e

  • SHA1

    7996ba923d8b0afc9c0d8843be1e26b4dc60189a

  • SHA256

    a245263269ea23b72af459e57d9a0cd52d3a45c9d3f26b147690a1f7313bcd2d

  • SHA512

    8aad28d452cc0ec21caeda3a1727a8a3fa410e4d586aa58b68be57b5d99c55b70e353c00fd088350a62dc2b9b041f6a3c4046fa4be7c83dda7ccc904741ece77

  • SSDEEP

    3072:H454SO+JAqXfKoyNYpEQc4HIpqXQSo3PrW8vQk5QJg7E5ae:H4KTezyNYpEhHpQQfPrkJg7a

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.20:13441

Targets

    • Target

      a245263269ea23b72af459e57d9a0cd52d3a45c9d3f26b147690a1f7313bcd2d

    • Size

      224KB

    • MD5

      ef146a56f4782ae2662ecc10ffae3e9e

    • SHA1

      7996ba923d8b0afc9c0d8843be1e26b4dc60189a

    • SHA256

      a245263269ea23b72af459e57d9a0cd52d3a45c9d3f26b147690a1f7313bcd2d

    • SHA512

      8aad28d452cc0ec21caeda3a1727a8a3fa410e4d586aa58b68be57b5d99c55b70e353c00fd088350a62dc2b9b041f6a3c4046fa4be7c83dda7ccc904741ece77

    • SSDEEP

      3072:H454SO+JAqXfKoyNYpEQc4HIpqXQSo3PrW8vQk5QJg7E5ae:H4KTezyNYpEhHpQQfPrkJg7a

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks