General

  • Target

    6938624d6d7d3dac9d91a84e2553f2e38c3021cfa24043e248d081b76bc64148

  • Size

    320KB

  • Sample

    241111-dwe97s1lav

  • MD5

    b1f15187e00813da4f664ff4e8269d1d

  • SHA1

    7a452e51276d3dae93d8a6fe839104a1f8cf171c

  • SHA256

    6938624d6d7d3dac9d91a84e2553f2e38c3021cfa24043e248d081b76bc64148

  • SHA512

    c536bdc0eb127b7726f074600600ba0eedf908d0b39a050ce3c2af66ce619b44ed479651a42ea53b528fae42ea803279fd71761f260d86d6aaf5a381566fc3a9

  • SSDEEP

    6144:0mPLCq4Tj46AblwyQgHvtQGCjxz5JHDAjP:1L+TeTtQ/SP

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.20:13441

Targets

    • Target

      6938624d6d7d3dac9d91a84e2553f2e38c3021cfa24043e248d081b76bc64148

    • Size

      320KB

    • MD5

      b1f15187e00813da4f664ff4e8269d1d

    • SHA1

      7a452e51276d3dae93d8a6fe839104a1f8cf171c

    • SHA256

      6938624d6d7d3dac9d91a84e2553f2e38c3021cfa24043e248d081b76bc64148

    • SHA512

      c536bdc0eb127b7726f074600600ba0eedf908d0b39a050ce3c2af66ce619b44ed479651a42ea53b528fae42ea803279fd71761f260d86d6aaf5a381566fc3a9

    • SSDEEP

      6144:0mPLCq4Tj46AblwyQgHvtQGCjxz5JHDAjP:1L+TeTtQ/SP

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks