General

  • Target

    6e8443a05321e39c7ba0276daa8fc90033c06c20ec53700e4df748142d064c1b.exe

  • Size

    337KB

  • Sample

    241123-x4tmcaylfm

  • MD5

    c9e1a2513a8255c49a10a6af0cf78382

  • SHA1

    15da843a1f75e1ae973d15e0d16983cece6d5377

  • SHA256

    6e8443a05321e39c7ba0276daa8fc90033c06c20ec53700e4df748142d064c1b

  • SHA512

    87d3de5136b39bac14fa423fa944b9141406156ffbddfa3fece5bf85173a819b8dbda4f6b672d1d9cb575851ef79c65c375e1fb28b8f8ef9fbe86080ef8b62f9

  • SSDEEP

    6144:/0Ati694HdFpPfSfWiECXgO9pYyGCHAZj7MqX7tNfVXVHQLIiu8cH:/0b69UN6fvZYyGtcwZGEX8cH

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      6e8443a05321e39c7ba0276daa8fc90033c06c20ec53700e4df748142d064c1b.exe

    • Size

      337KB

    • MD5

      c9e1a2513a8255c49a10a6af0cf78382

    • SHA1

      15da843a1f75e1ae973d15e0d16983cece6d5377

    • SHA256

      6e8443a05321e39c7ba0276daa8fc90033c06c20ec53700e4df748142d064c1b

    • SHA512

      87d3de5136b39bac14fa423fa944b9141406156ffbddfa3fece5bf85173a819b8dbda4f6b672d1d9cb575851ef79c65c375e1fb28b8f8ef9fbe86080ef8b62f9

    • SSDEEP

      6144:/0Ati694HdFpPfSfWiECXgO9pYyGCHAZj7MqX7tNfVXVHQLIiu8cH:/0b69UN6fvZYyGtcwZGEX8cH

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks