General

  • Target

    ad8b4a5ab95b7a8bcbfd6f13f22cac14936cd03e47d1a77959ddff776bd9e2e4

  • Size

    292KB

  • Sample

    241111-mw68csxngy

  • MD5

    e081791ef5971c99353e27688d4ea5be

  • SHA1

    50573f4d3c2969621677e7a7348b0632d8f04c61

  • SHA256

    ad8b4a5ab95b7a8bcbfd6f13f22cac14936cd03e47d1a77959ddff776bd9e2e4

  • SHA512

    0c3356de0d33e04b77c876785abe5bf58d8bb4ee94b843bf35cfda3153ea8ea6068ca534168a68e5650640d63ee9da811558bc9b0e31af985e1a72c5bbb29b12

  • SSDEEP

    6144:U3T9vLfSj197nC6n/XRVG6Gqo0IUdnQ9/Aar4N:upLSj19DC+/hPC9

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      ad8b4a5ab95b7a8bcbfd6f13f22cac14936cd03e47d1a77959ddff776bd9e2e4

    • Size

      292KB

    • MD5

      e081791ef5971c99353e27688d4ea5be

    • SHA1

      50573f4d3c2969621677e7a7348b0632d8f04c61

    • SHA256

      ad8b4a5ab95b7a8bcbfd6f13f22cac14936cd03e47d1a77959ddff776bd9e2e4

    • SHA512

      0c3356de0d33e04b77c876785abe5bf58d8bb4ee94b843bf35cfda3153ea8ea6068ca534168a68e5650640d63ee9da811558bc9b0e31af985e1a72c5bbb29b12

    • SSDEEP

      6144:U3T9vLfSj197nC6n/XRVG6Gqo0IUdnQ9/Aar4N:upLSj19DC+/hPC9

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks