General

  • Target

    4cb831b147e69374ab7a1ec981503220879b7643226f93432b509457a0dab563

  • Size

    264KB

  • Sample

    241109-axh6pswlen

  • MD5

    26afcebbced82eb882395302e85872e5

  • SHA1

    b4a77eb8b69ef09bc1327aec88fe51a9d31c6140

  • SHA256

    4cb831b147e69374ab7a1ec981503220879b7643226f93432b509457a0dab563

  • SHA512

    cbae8af9ede5f6983126e7d84555c9476567784987f20df25554e6cb1888a59b0fdb006a7f2707346a19740a7ab970b3aa0661a9c4ead36a0ed911b691a3152c

  • SSDEEP

    6144:nrn9LkgpzL3VGKvpAvXtBLutI2uJhQFhE1EkPLrdrRg2wUxJg:rn9AgVLFtpAvruwJhQbuZrFRDY

Malware Config

Extracted

Family

redline

Botnet

installbot_mix2

C2

185.118.165.94:15838

Targets

    • Target

      4cb831b147e69374ab7a1ec981503220879b7643226f93432b509457a0dab563

    • Size

      264KB

    • MD5

      26afcebbced82eb882395302e85872e5

    • SHA1

      b4a77eb8b69ef09bc1327aec88fe51a9d31c6140

    • SHA256

      4cb831b147e69374ab7a1ec981503220879b7643226f93432b509457a0dab563

    • SHA512

      cbae8af9ede5f6983126e7d84555c9476567784987f20df25554e6cb1888a59b0fdb006a7f2707346a19740a7ab970b3aa0661a9c4ead36a0ed911b691a3152c

    • SSDEEP

      6144:nrn9LkgpzL3VGKvpAvXtBLutI2uJhQFhE1EkPLrdrRg2wUxJg:rn9AgVLFtpAvruwJhQbuZrFRDY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks