General

  • Target

    9c1e2297290de1bee728e5a51f32cef404b74f7b615f4934158c082f1800e00d

  • Size

    276KB

  • Sample

    241108-hvfxkazpgn

  • MD5

    156799df3e4667684846848785de7b11

  • SHA1

    2d15db2cf513d9f6a4d29a2d7f2e52b8b2d18edd

  • SHA256

    9c1e2297290de1bee728e5a51f32cef404b74f7b615f4934158c082f1800e00d

  • SHA512

    7fbaecc2a4d27cd1baa362333b112d2b41fc08500b886bc4e76af27b7309f463acd92fd9f9fa643212fd3d6586ad97a0f2605c5e7a314a01102def611f979884

  • SSDEEP

    6144:jO+DO8wAFf05/wkFIL7h81eUjrRgFjwxJg:jO+K8fGZAHO1eIRvY

Malware Config

Extracted

Family

redline

Botnet

installbot_mix2

C2

185.118.165.94:15838

Targets

    • Target

      9c1e2297290de1bee728e5a51f32cef404b74f7b615f4934158c082f1800e00d

    • Size

      276KB

    • MD5

      156799df3e4667684846848785de7b11

    • SHA1

      2d15db2cf513d9f6a4d29a2d7f2e52b8b2d18edd

    • SHA256

      9c1e2297290de1bee728e5a51f32cef404b74f7b615f4934158c082f1800e00d

    • SHA512

      7fbaecc2a4d27cd1baa362333b112d2b41fc08500b886bc4e76af27b7309f463acd92fd9f9fa643212fd3d6586ad97a0f2605c5e7a314a01102def611f979884

    • SSDEEP

      6144:jO+DO8wAFf05/wkFIL7h81eUjrRgFjwxJg:jO+K8fGZAHO1eIRvY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks