General

  • Target

    53a3ead0f3fdffba879eebec47833926e5eeb768e50c99b3c738428ee1259ce0

  • Size

    265KB

  • Sample

    241106-p77z5szkhx

  • MD5

    30a178d034547f588de8c5c240e69696

  • SHA1

    39f680b8b94b637291a4aba13d587de5b4be87f7

  • SHA256

    53a3ead0f3fdffba879eebec47833926e5eeb768e50c99b3c738428ee1259ce0

  • SHA512

    124db5d6d535527e7eb31817f8ac6c7deceefc09e83767e6bcb77db1f81e78c2053410e8b30167cb616569d2846c7b15ba8bdfb2a2ca018816d55b8b80bc78dd

  • SSDEEP

    6144:8rn9Lk0+ZkG8YX/FpyOz2SO4mQAg8WSSJPrRgqwxxJg:cn9A0+Zf8YPFpnz2thy/DRKY

Malware Config

Extracted

Family

redline

Botnet

installbot_mix2

C2

185.118.165.94:15838

Targets

    • Target

      53a3ead0f3fdffba879eebec47833926e5eeb768e50c99b3c738428ee1259ce0

    • Size

      265KB

    • MD5

      30a178d034547f588de8c5c240e69696

    • SHA1

      39f680b8b94b637291a4aba13d587de5b4be87f7

    • SHA256

      53a3ead0f3fdffba879eebec47833926e5eeb768e50c99b3c738428ee1259ce0

    • SHA512

      124db5d6d535527e7eb31817f8ac6c7deceefc09e83767e6bcb77db1f81e78c2053410e8b30167cb616569d2846c7b15ba8bdfb2a2ca018816d55b8b80bc78dd

    • SSDEEP

      6144:8rn9Lk0+ZkG8YX/FpyOz2SO4mQAg8WSSJPrRgqwxxJg:cn9A0+Zf8YPFpnz2thy/DRKY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks