General

  • Target

    0b52ba3e660e6e89c951fab71100c10cc180c4ae1ccc2e40e828a8ce77432082.exe

  • Size

    369KB

  • Sample

    241122-p3l7wa1kex

  • MD5

    5a509a8786ece81c0bc59b4f3f1467a6

  • SHA1

    f88775d138358a9bd6f3ae978c846e040ab037ee

  • SHA256

    0b52ba3e660e6e89c951fab71100c10cc180c4ae1ccc2e40e828a8ce77432082

  • SHA512

    079e66fa845b518921c66488b496a6b006d8223e8d0ff19ee28f845b0149c8c01384e46c10f206d3405fcaeb3e350bb3dbd3f788ef8a9e5c12c42a712cfa9f98

  • SSDEEP

    6144:wtkym9ql+YRNeo6Av6vpdyKWrD5Cfi02GfukbtsUtNl6:iTm9y+iUA4yKE5JGfukbtsyNM

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      0b52ba3e660e6e89c951fab71100c10cc180c4ae1ccc2e40e828a8ce77432082.exe

    • Size

      369KB

    • MD5

      5a509a8786ece81c0bc59b4f3f1467a6

    • SHA1

      f88775d138358a9bd6f3ae978c846e040ab037ee

    • SHA256

      0b52ba3e660e6e89c951fab71100c10cc180c4ae1ccc2e40e828a8ce77432082

    • SHA512

      079e66fa845b518921c66488b496a6b006d8223e8d0ff19ee28f845b0149c8c01384e46c10f206d3405fcaeb3e350bb3dbd3f788ef8a9e5c12c42a712cfa9f98

    • SSDEEP

      6144:wtkym9ql+YRNeo6Av6vpdyKWrD5Cfi02GfukbtsUtNl6:iTm9y+iUA4yKE5JGfukbtsyNM

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks