General

  • Target

    build9exe.exe

  • Size

    95KB

  • Sample

    230701-jl3weahb5w

  • MD5

    2c5a75b7d24847bc5d206adb5c630a18

  • SHA1

    89ca4d98947ab1248c022d66a23279f04cca6bbf

  • SHA256

    dd09828ffbfdd784f83cac83641b8a0c3ca04b76becabb0ab5d170ad1bc169a7

  • SHA512

    2ff1ad476ea1c72f6e1cda33f601e2eae06ca87bf4554cd085e17512a88ad515e95d42706e8e0a2c2b1fe17c9e0f1c511ef1554333d17a7e6e111b1531acc789

  • SSDEEP

    1536:Fqs8haqpalbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2YtmulgS6pQl:DiaKaYP+zi0ZbYe1g0ujyzdsQ

Malware Config

Extracted

Family

redline

Botnet

crypto

C2

163.123.142.235:61068

Targets

    • Target

      build9exe.exe

    • Size

      95KB

    • MD5

      2c5a75b7d24847bc5d206adb5c630a18

    • SHA1

      89ca4d98947ab1248c022d66a23279f04cca6bbf

    • SHA256

      dd09828ffbfdd784f83cac83641b8a0c3ca04b76becabb0ab5d170ad1bc169a7

    • SHA512

      2ff1ad476ea1c72f6e1cda33f601e2eae06ca87bf4554cd085e17512a88ad515e95d42706e8e0a2c2b1fe17c9e0f1c511ef1554333d17a7e6e111b1531acc789

    • SSDEEP

      1536:Fqs8haqpalbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2YtmulgS6pQl:DiaKaYP+zi0ZbYe1g0ujyzdsQ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks