General

  • Target

    generator.dll.exe

  • Size

    12KB

  • Sample

    230517-nb43yaeg58

  • MD5

    03c3f979feffbf02e7ab9a66f9a1f7b4

  • SHA1

    826e5038b32c3975821eb8641e484b575fdfa7e9

  • SHA256

    f746b0a6d47ddc6b6a03d78a7dca6e61bbb32a35cdf89073cd245eb4662cfbfd

  • SHA512

    14451960a5e111d44d58e0660a0d5f1dfcae74046fd595d6e8f758c0d01181141201af0813425e571f2296b9cab2ed314ac2a65d1ba139d4deaf6180b5e9a8ea

  • SSDEEP

    192:wMJ0X7yZWu7s3+7DBPSVcWF28A6lJGNyQK+NAA5yQ03826p:wvLygTO7D4qWF28bJHQllm6

Malware Config

Extracted

Family

redline

Botnet

Love Fi Lo

C2

111.90.149.195:55186

Targets

    • Target

      generator.dll.exe

    • Size

      12KB

    • MD5

      03c3f979feffbf02e7ab9a66f9a1f7b4

    • SHA1

      826e5038b32c3975821eb8641e484b575fdfa7e9

    • SHA256

      f746b0a6d47ddc6b6a03d78a7dca6e61bbb32a35cdf89073cd245eb4662cfbfd

    • SHA512

      14451960a5e111d44d58e0660a0d5f1dfcae74046fd595d6e8f758c0d01181141201af0813425e571f2296b9cab2ed314ac2a65d1ba139d4deaf6180b5e9a8ea

    • SSDEEP

      192:wMJ0X7yZWu7s3+7DBPSVcWF28A6lJGNyQK+NAA5yQ03826p:wvLygTO7D4qWF28bJHQllm6

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks