General

  • Target

    81f49558c538e47be00735ebb5f585baa51a7635eeba8b9915c9dcca95a82dc6.exe

  • Size

    406KB

  • Sample

    241123-d4e96stldm

  • MD5

    88f7b9e063f145a6aeda0c018440fa84

  • SHA1

    c3db1fb1b92a5e1e3e84bf45f2b64528e10c4a3e

  • SHA256

    81f49558c538e47be00735ebb5f585baa51a7635eeba8b9915c9dcca95a82dc6

  • SHA512

    610cf8c2c18fc0c36afca9ccbebac95e70af01e07c50f4b2358462e07202e05756c002d76aec129eaaa26bfa6c91feef2c9a70b89ade1d3c41ebad203c7b06c9

  • SSDEEP

    12288:pzWMTPbquMeMX2MwIDLWGedrKC1Sh8k4St4CJ:pPWX2MrLfC1E88J

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      81f49558c538e47be00735ebb5f585baa51a7635eeba8b9915c9dcca95a82dc6.exe

    • Size

      406KB

    • MD5

      88f7b9e063f145a6aeda0c018440fa84

    • SHA1

      c3db1fb1b92a5e1e3e84bf45f2b64528e10c4a3e

    • SHA256

      81f49558c538e47be00735ebb5f585baa51a7635eeba8b9915c9dcca95a82dc6

    • SHA512

      610cf8c2c18fc0c36afca9ccbebac95e70af01e07c50f4b2358462e07202e05756c002d76aec129eaaa26bfa6c91feef2c9a70b89ade1d3c41ebad203c7b06c9

    • SSDEEP

      12288:pzWMTPbquMeMX2MwIDLWGedrKC1Sh8k4St4CJ:pPWX2MrLfC1E88J

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks