General

  • Target

    1952e0fe5440d624c037cc5753bf8980b70ff2db4b21b6a3a230004b2af0d2a6

  • Size

    412KB

  • Sample

    241111-k4km8azrem

  • MD5

    7dc3dd79b3c8cdc7c2573e5e49bb16b5

  • SHA1

    b9dfeab08a8f5a8678b99633efaa1dbc816ebcad

  • SHA256

    1952e0fe5440d624c037cc5753bf8980b70ff2db4b21b6a3a230004b2af0d2a6

  • SHA512

    f9ee883c9572b3ba1239a1b7ceddd70b4a50b4aa433c51c0b74301f2367037c0af2f69e62e55e171dae36f52037405976328e15dfb5919045d983fb351c757df

  • SSDEEP

    6144:EcY7VI4Osl3YxXZasIXUgQIreBqK5oHLUbIlruQOvgBEsGC1mx:fYxI4OAYhZVIX6ZoMorUUrGvgBEsNU

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      1952e0fe5440d624c037cc5753bf8980b70ff2db4b21b6a3a230004b2af0d2a6

    • Size

      412KB

    • MD5

      7dc3dd79b3c8cdc7c2573e5e49bb16b5

    • SHA1

      b9dfeab08a8f5a8678b99633efaa1dbc816ebcad

    • SHA256

      1952e0fe5440d624c037cc5753bf8980b70ff2db4b21b6a3a230004b2af0d2a6

    • SHA512

      f9ee883c9572b3ba1239a1b7ceddd70b4a50b4aa433c51c0b74301f2367037c0af2f69e62e55e171dae36f52037405976328e15dfb5919045d983fb351c757df

    • SSDEEP

      6144:EcY7VI4Osl3YxXZasIXUgQIreBqK5oHLUbIlruQOvgBEsGC1mx:fYxI4OAYhZVIX6ZoMorUUrGvgBEsNU

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks