General

  • Target

    ba9d9affc318d057e8684c8d011d1277d9f43eca3944dad818a5a6a9405f3d63

  • Size

    408KB

  • Sample

    241111-jjmreawdrd

  • MD5

    b6a2ee1adc1c70332f0a2f08383e2859

  • SHA1

    725937e2e92b5d80b1214a1cc71fd75695276af3

  • SHA256

    ba9d9affc318d057e8684c8d011d1277d9f43eca3944dad818a5a6a9405f3d63

  • SHA512

    2ee7a55a758ee105788631cd1d941408f894dfbb764f729956a6987025dabc3f07b3283fecae1b33d19d30ce1bc294d70f302de8da2c4bd222741aefc4c10ab9

  • SSDEEP

    12288:jes4TcYYlC6sUxcAh4Cv4uh8qoAgF+okGk9qcIN:jeZkxxZhTLgQokhMcIN

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      ba9d9affc318d057e8684c8d011d1277d9f43eca3944dad818a5a6a9405f3d63

    • Size

      408KB

    • MD5

      b6a2ee1adc1c70332f0a2f08383e2859

    • SHA1

      725937e2e92b5d80b1214a1cc71fd75695276af3

    • SHA256

      ba9d9affc318d057e8684c8d011d1277d9f43eca3944dad818a5a6a9405f3d63

    • SHA512

      2ee7a55a758ee105788631cd1d941408f894dfbb764f729956a6987025dabc3f07b3283fecae1b33d19d30ce1bc294d70f302de8da2c4bd222741aefc4c10ab9

    • SSDEEP

      12288:jes4TcYYlC6sUxcAh4Cv4uh8qoAgF+okGk9qcIN:jeZkxxZhTLgQokhMcIN

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks