General

  • Target

    04545524e0f035f178ab770c9e0ddbfa28f7d3be883a5e82b96f143c7200eec3.exe

  • Size

    370KB

  • Sample

    241122-nkjtcswjdn

  • MD5

    fd2a0a75fe3d1338edd547cc0ee875da

  • SHA1

    3969bc086c6208e0c19b27f098efab8614308ceb

  • SHA256

    04545524e0f035f178ab770c9e0ddbfa28f7d3be883a5e82b96f143c7200eec3

  • SHA512

    dde353e10afa372dc996b7cf047c18aa0c91e63e575894b78792dfe8d4c7f06aa9e2760d9c8a5efe8ae57204e88a0ef520c5775ca217e333db9c441c955ee8ae

  • SSDEEP

    6144:qhIThNgnnTAReO9KcYZPyXYNU4ih/CdcPm66dJo8j9vsv+iV:jNanT10XY64ih/CdX66dJouO+iV

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      04545524e0f035f178ab770c9e0ddbfa28f7d3be883a5e82b96f143c7200eec3.exe

    • Size

      370KB

    • MD5

      fd2a0a75fe3d1338edd547cc0ee875da

    • SHA1

      3969bc086c6208e0c19b27f098efab8614308ceb

    • SHA256

      04545524e0f035f178ab770c9e0ddbfa28f7d3be883a5e82b96f143c7200eec3

    • SHA512

      dde353e10afa372dc996b7cf047c18aa0c91e63e575894b78792dfe8d4c7f06aa9e2760d9c8a5efe8ae57204e88a0ef520c5775ca217e333db9c441c955ee8ae

    • SSDEEP

      6144:qhIThNgnnTAReO9KcYZPyXYNU4ih/CdcPm66dJo8j9vsv+iV:jNanT10XY64ih/CdX66dJouO+iV

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks