General

  • Target

    d6abeeb0b40c22881e49d272d29a0e84e7b9110d2e1f86c7aa24ef22c3b07fde

  • Size

    291KB

  • Sample

    241111-gwsr3svalm

  • MD5

    5c5980a9718cc9a9de2ef518c28a4fe5

  • SHA1

    a9553f12ddc772550000a8bd1536c81f9589913f

  • SHA256

    d6abeeb0b40c22881e49d272d29a0e84e7b9110d2e1f86c7aa24ef22c3b07fde

  • SHA512

    f573ac4dda6dcc829b0d552e646690ea7d9e6004a1e13f520b3068255c11a5211eeb660505d7883f884e94cd1bec327c8cfcfc316be50a4976dce12974dac9c4

  • SSDEEP

    6144:+LT9vLXSf1X52g3hOf8jH5HQVjDehd/vVFV:cpTSf1X3ROYZwZehR

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      d6abeeb0b40c22881e49d272d29a0e84e7b9110d2e1f86c7aa24ef22c3b07fde

    • Size

      291KB

    • MD5

      5c5980a9718cc9a9de2ef518c28a4fe5

    • SHA1

      a9553f12ddc772550000a8bd1536c81f9589913f

    • SHA256

      d6abeeb0b40c22881e49d272d29a0e84e7b9110d2e1f86c7aa24ef22c3b07fde

    • SHA512

      f573ac4dda6dcc829b0d552e646690ea7d9e6004a1e13f520b3068255c11a5211eeb660505d7883f884e94cd1bec327c8cfcfc316be50a4976dce12974dac9c4

    • SSDEEP

      6144:+LT9vLXSf1X52g3hOf8jH5HQVjDehd/vVFV:cpTSf1X3ROYZwZehR

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks