General

  • Target

    05705f82f66a09310769b75bc356055f1aee86b7a4815bf3f2c5770181459e97

  • Size

    409KB

  • Sample

    241111-kadmtaweqm

  • MD5

    17976604f93d6103fa57dfb32da349e0

  • SHA1

    3cdfaf29d4bdc2169ba32f2c4dc6c3748120b003

  • SHA256

    05705f82f66a09310769b75bc356055f1aee86b7a4815bf3f2c5770181459e97

  • SHA512

    5f10adfa0ea53667d1448a1328188ffc3bab19592bd8ee45a7e33e96ac8d2ee078eff90e0a464e7338686c0f1313dfeab1a4e47486b6ba8f19879282fdbff36c

  • SSDEEP

    12288:nu2sVp3QU6KCW/yqYhyldMgzTO9kPicrq:nYtaAWg/O9gtrq

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      05705f82f66a09310769b75bc356055f1aee86b7a4815bf3f2c5770181459e97

    • Size

      409KB

    • MD5

      17976604f93d6103fa57dfb32da349e0

    • SHA1

      3cdfaf29d4bdc2169ba32f2c4dc6c3748120b003

    • SHA256

      05705f82f66a09310769b75bc356055f1aee86b7a4815bf3f2c5770181459e97

    • SHA512

      5f10adfa0ea53667d1448a1328188ffc3bab19592bd8ee45a7e33e96ac8d2ee078eff90e0a464e7338686c0f1313dfeab1a4e47486b6ba8f19879282fdbff36c

    • SSDEEP

      12288:nu2sVp3QU6KCW/yqYhyldMgzTO9kPicrq:nYtaAWg/O9gtrq

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks