General

  • Target

    ac6d4c81d4026278bcb5120f71f1d23a8b3fa4e6895e3d735a547e5dcb0f7b4e.exe

  • Size

    369KB

  • Sample

    241121-g858yazfkp

  • MD5

    35ba1dcb74b0ea58cfc951253cdd0e1f

  • SHA1

    fb6ecc37e04d6849fe21b275ecaba83c5127f1a3

  • SHA256

    ac6d4c81d4026278bcb5120f71f1d23a8b3fa4e6895e3d735a547e5dcb0f7b4e

  • SHA512

    5d8828046a11343194a9d8b225034bdbc5554d3b6456f04a985a602509b03a9219c8b38f2a1defa5fb03add9951f4f306bbb40c249aa556b59d8c4a8d1750adc

  • SSDEEP

    6144:KTJJI44SI5nnx6F/Q+okePz9WrA5CS5x7GvmQaDtMEp712+nq:KTJX4SIn6FYVXz9H5XGvmQaDt0

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      ac6d4c81d4026278bcb5120f71f1d23a8b3fa4e6895e3d735a547e5dcb0f7b4e.exe

    • Size

      369KB

    • MD5

      35ba1dcb74b0ea58cfc951253cdd0e1f

    • SHA1

      fb6ecc37e04d6849fe21b275ecaba83c5127f1a3

    • SHA256

      ac6d4c81d4026278bcb5120f71f1d23a8b3fa4e6895e3d735a547e5dcb0f7b4e

    • SHA512

      5d8828046a11343194a9d8b225034bdbc5554d3b6456f04a985a602509b03a9219c8b38f2a1defa5fb03add9951f4f306bbb40c249aa556b59d8c4a8d1750adc

    • SSDEEP

      6144:KTJJI44SI5nnx6F/Q+okePz9WrA5CS5x7GvmQaDtMEp712+nq:KTJX4SIn6FYVXz9H5XGvmQaDt0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks