General

  • Target

    023fc47c6f52055984cb9c8a332d4b0c6a7eec2e5c67bda4bff51afdff4f599d

  • Size

    224KB

  • Sample

    241104-z75j5azpal

  • MD5

    663c4cdae495142d1d0ebf5303d62210

  • SHA1

    48250f082830d96239516ade98f03109596c8fa3

  • SHA256

    023fc47c6f52055984cb9c8a332d4b0c6a7eec2e5c67bda4bff51afdff4f599d

  • SHA512

    af5abeb533ac689be23b163639c557689859f4cd13bf1d831fc216f1ee8507cbeba3f9c634dbfc163221c748b464e7fa4c683a737f6eefc7364e8d78f41a92e7

  • SSDEEP

    3072:8OuvnLYducl+wHwBIKetzz04LAreM0WPhYuJNiu+SChU7MPISMwi9QV5bNhk5YcW:MvnLYX+Crzh04LPwZ/INiObN1

Malware Config

Extracted

Family

redline

Botnet

installbot_mix2

C2

185.118.165.94:15838

Targets

    • Target

      023fc47c6f52055984cb9c8a332d4b0c6a7eec2e5c67bda4bff51afdff4f599d

    • Size

      224KB

    • MD5

      663c4cdae495142d1d0ebf5303d62210

    • SHA1

      48250f082830d96239516ade98f03109596c8fa3

    • SHA256

      023fc47c6f52055984cb9c8a332d4b0c6a7eec2e5c67bda4bff51afdff4f599d

    • SHA512

      af5abeb533ac689be23b163639c557689859f4cd13bf1d831fc216f1ee8507cbeba3f9c634dbfc163221c748b464e7fa4c683a737f6eefc7364e8d78f41a92e7

    • SSDEEP

      3072:8OuvnLYducl+wHwBIKetzz04LAreM0WPhYuJNiu+SChU7MPISMwi9QV5bNhk5YcW:MvnLYX+Crzh04LPwZ/INiObN1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks