General

  • Target

    1c985ac01483ba37136f6b00ae184e8f17dc4962755649d5bd84fb2dd8ee94a5

  • Size

    265KB

  • Sample

    241105-wb5ngavlhz

  • MD5

    b624b0aaf6ce0b0eca6189bba8ac5088

  • SHA1

    920d7ef88e560360da4e33542a6f2234aa5b65c1

  • SHA256

    1c985ac01483ba37136f6b00ae184e8f17dc4962755649d5bd84fb2dd8ee94a5

  • SHA512

    80dce12792e7d9eade9fe7486ec983869a5286efa8196b6f41077019edf08cbe135230674f8e6c33353526c402e114ba4a61ee2a2eab03839490e5a27c7c2a81

  • SSDEEP

    6144:zrn9LkUatv3YRr26hw/mz7EVBxKuPErRgmRxJg:/n9AN2rTGmm/KuyRdRY

Malware Config

Extracted

Family

redline

Botnet

installbot_mix2

C2

185.118.165.94:15838

Targets

    • Target

      1c985ac01483ba37136f6b00ae184e8f17dc4962755649d5bd84fb2dd8ee94a5

    • Size

      265KB

    • MD5

      b624b0aaf6ce0b0eca6189bba8ac5088

    • SHA1

      920d7ef88e560360da4e33542a6f2234aa5b65c1

    • SHA256

      1c985ac01483ba37136f6b00ae184e8f17dc4962755649d5bd84fb2dd8ee94a5

    • SHA512

      80dce12792e7d9eade9fe7486ec983869a5286efa8196b6f41077019edf08cbe135230674f8e6c33353526c402e114ba4a61ee2a2eab03839490e5a27c7c2a81

    • SSDEEP

      6144:zrn9LkUatv3YRr26hw/mz7EVBxKuPErRgmRxJg:/n9AN2rTGmm/KuyRdRY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks