General

  • Target

    b6c78eb9d12160366a71cbe04e4cc71bcfcabc8a4ddedaddb7cb3b48edaf6752

  • Size

    265KB

  • Sample

    241108-g7sw8axekh

  • MD5

    d02f3532c5758a7448d29b11b0967dce

  • SHA1

    8dcabcbae6e470268561e7005a31c3f55b36cb55

  • SHA256

    b6c78eb9d12160366a71cbe04e4cc71bcfcabc8a4ddedaddb7cb3b48edaf6752

  • SHA512

    9968f51aa4184020fbb6f041aa549e0f062bfb4a0f6748e209397f9e5fa7b44115accdc2777f5570bc9ab415164c89bc8a45a42a0f36986f05afb6dd1e4295ad

  • SSDEEP

    6144:IvnLYsvQWEPc7VjCe/ktUSG+L24iMGrRgVIDxJg:IvnEsIJPcwtUS7mRBY

Malware Config

Extracted

Family

redline

Botnet

installbot_mix2

C2

185.118.165.94:15838

Targets

    • Target

      b6c78eb9d12160366a71cbe04e4cc71bcfcabc8a4ddedaddb7cb3b48edaf6752

    • Size

      265KB

    • MD5

      d02f3532c5758a7448d29b11b0967dce

    • SHA1

      8dcabcbae6e470268561e7005a31c3f55b36cb55

    • SHA256

      b6c78eb9d12160366a71cbe04e4cc71bcfcabc8a4ddedaddb7cb3b48edaf6752

    • SHA512

      9968f51aa4184020fbb6f041aa549e0f062bfb4a0f6748e209397f9e5fa7b44115accdc2777f5570bc9ab415164c89bc8a45a42a0f36986f05afb6dd1e4295ad

    • SSDEEP

      6144:IvnLYsvQWEPc7VjCe/ktUSG+L24iMGrRgVIDxJg:IvnEsIJPcwtUS7mRBY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks