General

  • Target

    c92857f157f51505cf0e5bc357c3bb9e1f253cec77b48b75caf7a954382ed597

  • Size

    264KB

  • Sample

    241105-fq67vavfpe

  • MD5

    19ce66fe2707abbaef456de79d325c27

  • SHA1

    1d89926b71860fb0849188b91357fd1eed8ebdf2

  • SHA256

    c92857f157f51505cf0e5bc357c3bb9e1f253cec77b48b75caf7a954382ed597

  • SHA512

    a817f3d47e38143fab073c8f7554258aa105b7bb0d911f4c23bb2a563c83272f06602bb75b7434bc3c08c59e38202f9cdc39d85d7ccc5b337716757efb752d54

  • SSDEEP

    6144:VvnLY4Oq8ryvoMStaskBaptxG45xrRglFRExJg:VvnE43iasIuxLPRaFqY

Malware Config

Extracted

Family

redline

Botnet

installbot_mix2

C2

185.118.165.94:15838

Targets

    • Target

      c92857f157f51505cf0e5bc357c3bb9e1f253cec77b48b75caf7a954382ed597

    • Size

      264KB

    • MD5

      19ce66fe2707abbaef456de79d325c27

    • SHA1

      1d89926b71860fb0849188b91357fd1eed8ebdf2

    • SHA256

      c92857f157f51505cf0e5bc357c3bb9e1f253cec77b48b75caf7a954382ed597

    • SHA512

      a817f3d47e38143fab073c8f7554258aa105b7bb0d911f4c23bb2a563c83272f06602bb75b7434bc3c08c59e38202f9cdc39d85d7ccc5b337716757efb752d54

    • SSDEEP

      6144:VvnLY4Oq8ryvoMStaskBaptxG45xrRglFRExJg:VvnE43iasIuxLPRaFqY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks