General

  • Target

    d2f15549eb63b96c5533d4e78415a941f46e62bd7223b24bd1a2bfa7291d6830.exe

  • Size

    95KB

  • Sample

    241003-cllhssyhkm

  • MD5

    115800c58d1b88a63b134edca8a57084

  • SHA1

    a579889ace4bfd7bcc83b8d920fb66f972c6c202

  • SHA256

    d2f15549eb63b96c5533d4e78415a941f46e62bd7223b24bd1a2bfa7291d6830

  • SHA512

    9315503b562f0be86ee44509ef3c735d505a372af63d4df72efec49255ce81cdf19994be600a7a60a66fc4a5dea769f1ccd870b39aa720852a463722bf7579b9

  • SSDEEP

    1536:5qsCOqJGlbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2JteulgS6p8l:X1uOYj+zi0ZbYe1g0ujyzdV8

Malware Config

Extracted

Family

redline

Botnet

Log887

C2

143.198.123.84:42078

Targets

    • Target

      d2f15549eb63b96c5533d4e78415a941f46e62bd7223b24bd1a2bfa7291d6830.exe

    • Size

      95KB

    • MD5

      115800c58d1b88a63b134edca8a57084

    • SHA1

      a579889ace4bfd7bcc83b8d920fb66f972c6c202

    • SHA256

      d2f15549eb63b96c5533d4e78415a941f46e62bd7223b24bd1a2bfa7291d6830

    • SHA512

      9315503b562f0be86ee44509ef3c735d505a372af63d4df72efec49255ce81cdf19994be600a7a60a66fc4a5dea769f1ccd870b39aa720852a463722bf7579b9

    • SSDEEP

      1536:5qsCOqJGlbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2JteulgS6p8l:X1uOYj+zi0ZbYe1g0ujyzdV8

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks