General

  • Target

    1eea64fe8394fd4e8b3a3ddf9cf3e135fb4b0caa8eeb7f47db4b5b8e3d7026e1.exe

  • Size

    336KB

  • Sample

    241121-bkm5kaxaqh

  • MD5

    d8e29de05fdb0fe88e8855b7e1acc6ab

  • SHA1

    9eb329418500ff8eb0c98b96c71f31d076b09536

  • SHA256

    1eea64fe8394fd4e8b3a3ddf9cf3e135fb4b0caa8eeb7f47db4b5b8e3d7026e1

  • SHA512

    2165b1acc702fbff4711ca884d7945177f2e58ae3ea37c3b71dd87ed776a6982c289d1be72e16d097e79aadda2b43bd4ad2f9fd08a03543e06ad00db86c48b74

  • SSDEEP

    6144:XaVLvhLqiS7I21eD4pGj8QaRAiMOJOqUq9A8vRhVO0gIuLO:XaVLvRqi1F4IkRxMOJOqUf0hVOWEO

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      1eea64fe8394fd4e8b3a3ddf9cf3e135fb4b0caa8eeb7f47db4b5b8e3d7026e1.exe

    • Size

      336KB

    • MD5

      d8e29de05fdb0fe88e8855b7e1acc6ab

    • SHA1

      9eb329418500ff8eb0c98b96c71f31d076b09536

    • SHA256

      1eea64fe8394fd4e8b3a3ddf9cf3e135fb4b0caa8eeb7f47db4b5b8e3d7026e1

    • SHA512

      2165b1acc702fbff4711ca884d7945177f2e58ae3ea37c3b71dd87ed776a6982c289d1be72e16d097e79aadda2b43bd4ad2f9fd08a03543e06ad00db86c48b74

    • SSDEEP

      6144:XaVLvhLqiS7I21eD4pGj8QaRAiMOJOqUq9A8vRhVO0gIuLO:XaVLvRqi1F4IkRxMOJOqUf0hVOWEO

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks