General

  • Target

    edf5c30fde106ad8a9ece4222473d99f3a6aa05fa57274c1e8207666ea8fb7b9

  • Size

    353KB

  • Sample

    241111-hezpqstpe1

  • MD5

    ee432821d926c0549540f60cbc3150bd

  • SHA1

    5f2147c52a792037e94b59c99275d4b96c8f171a

  • SHA256

    edf5c30fde106ad8a9ece4222473d99f3a6aa05fa57274c1e8207666ea8fb7b9

  • SHA512

    43d2f955c34d5d63979a0fb852a23cf33eb1f124483657eebf7ed1937921b6e40207192472fd9ca66f6b60a23e314c0d70eac6d12f0311365a28929b1e8e906e

  • SSDEEP

    6144:PH/eywN/1KhFwhKACK05n0EjWQhesRfzcXAgfUVOWzLO9tSZm:neywl1KhFwhKA6VHe0Ywg8VO6C9tSZm

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      edf5c30fde106ad8a9ece4222473d99f3a6aa05fa57274c1e8207666ea8fb7b9

    • Size

      353KB

    • MD5

      ee432821d926c0549540f60cbc3150bd

    • SHA1

      5f2147c52a792037e94b59c99275d4b96c8f171a

    • SHA256

      edf5c30fde106ad8a9ece4222473d99f3a6aa05fa57274c1e8207666ea8fb7b9

    • SHA512

      43d2f955c34d5d63979a0fb852a23cf33eb1f124483657eebf7ed1937921b6e40207192472fd9ca66f6b60a23e314c0d70eac6d12f0311365a28929b1e8e906e

    • SSDEEP

      6144:PH/eywN/1KhFwhKACK05n0EjWQhesRfzcXAgfUVOWzLO9tSZm:neywl1KhFwhKA6VHe0Ywg8VO6C9tSZm

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks