General

  • Target

    01df9bb03ef56a32db9e0f8a4739573c43690ce62a15f1f10d0448539ae31b44

  • Size

    265KB

  • Sample

    241104-1vrm6sydql

  • MD5

    79b6bfe004c845ced1b0d7bac5138dd1

  • SHA1

    5474b7c79332bdf8ecdc09c3f40ef26d41e06770

  • SHA256

    01df9bb03ef56a32db9e0f8a4739573c43690ce62a15f1f10d0448539ae31b44

  • SHA512

    14b1b9c958bebcd56ed60b5bb1590436adfdb1be908c966a63984b4c180146d892cc7918793ac979db2f48dde4b8f594ec0d908061f91b87abf01eff3ebcc104

  • SSDEEP

    6144:Irn9LkULz/RZH8FfuOsOLMuZIrRg/qxJg:Qn9A+/RZH8sOLZGRqqY

Malware Config

Extracted

Family

redline

Botnet

installbot_mix2

C2

185.118.165.94:15838

Targets

    • Target

      01df9bb03ef56a32db9e0f8a4739573c43690ce62a15f1f10d0448539ae31b44

    • Size

      265KB

    • MD5

      79b6bfe004c845ced1b0d7bac5138dd1

    • SHA1

      5474b7c79332bdf8ecdc09c3f40ef26d41e06770

    • SHA256

      01df9bb03ef56a32db9e0f8a4739573c43690ce62a15f1f10d0448539ae31b44

    • SHA512

      14b1b9c958bebcd56ed60b5bb1590436adfdb1be908c966a63984b4c180146d892cc7918793ac979db2f48dde4b8f594ec0d908061f91b87abf01eff3ebcc104

    • SSDEEP

      6144:Irn9LkULz/RZH8FfuOsOLMuZIrRg/qxJg:Qn9A+/RZH8sOLZGRqqY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks