General

  • Target

    ed3e2dd7b93c9e77fa4a02faa2257e6d9e21ba9c6e31a67c98817d28c95af7c9.exe

  • Size

    407KB

  • Sample

    241124-axylds1mak

  • MD5

    4a4b209df6acf3566a599818b3f26d53

  • SHA1

    aa877365a79879b80d0f6135596374c80fde181e

  • SHA256

    ed3e2dd7b93c9e77fa4a02faa2257e6d9e21ba9c6e31a67c98817d28c95af7c9

  • SHA512

    061c42c5462231ff3c33d7066c162fa2b7110ea14d5a2679adc681d5742fd1171b05f285ef07ec453880b7da5aac5fa12e39f0c0feeaf351da65b02bb07542df

  • SSDEEP

    12288:J06uMKw97a9zVOmkAqB7udz/1c3pHedSb/:J0IzaxVOeqEtc3pHR

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      ed3e2dd7b93c9e77fa4a02faa2257e6d9e21ba9c6e31a67c98817d28c95af7c9.exe

    • Size

      407KB

    • MD5

      4a4b209df6acf3566a599818b3f26d53

    • SHA1

      aa877365a79879b80d0f6135596374c80fde181e

    • SHA256

      ed3e2dd7b93c9e77fa4a02faa2257e6d9e21ba9c6e31a67c98817d28c95af7c9

    • SHA512

      061c42c5462231ff3c33d7066c162fa2b7110ea14d5a2679adc681d5742fd1171b05f285ef07ec453880b7da5aac5fa12e39f0c0feeaf351da65b02bb07542df

    • SSDEEP

      12288:J06uMKw97a9zVOmkAqB7udz/1c3pHedSb/:J0IzaxVOeqEtc3pHR

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks