General

  • Target

    d0b76543cbca60e83b512ab39a20f8e9f54707e610b61851a54d8f51fd54ab32

  • Size

    224KB

  • Sample

    241109-hp6wssspaq

  • MD5

    e244e11cf56fb83cfe642e659af03d3e

  • SHA1

    30ef19c5729b77809ddbc14caa1e03e746b977f7

  • SHA256

    d0b76543cbca60e83b512ab39a20f8e9f54707e610b61851a54d8f51fd54ab32

  • SHA512

    864db295282c8c5f2923ba270e79649894fb5d0560b7b1189d1eda8da9955af83bd46548a404bdfb1d61de7fc7c0d77050b34e6d06830b20d9e79c4a2723dc01

  • SSDEEP

    6144:hvnLYwrhufUZyoI/t58g/cyS5UkVYj8gE:hvnEwtuf1oGv8gVS5U7w

Malware Config

Extracted

Family

redline

Botnet

installbot_mix2

C2

185.118.165.94:15838

Targets

    • Target

      d0b76543cbca60e83b512ab39a20f8e9f54707e610b61851a54d8f51fd54ab32

    • Size

      224KB

    • MD5

      e244e11cf56fb83cfe642e659af03d3e

    • SHA1

      30ef19c5729b77809ddbc14caa1e03e746b977f7

    • SHA256

      d0b76543cbca60e83b512ab39a20f8e9f54707e610b61851a54d8f51fd54ab32

    • SHA512

      864db295282c8c5f2923ba270e79649894fb5d0560b7b1189d1eda8da9955af83bd46548a404bdfb1d61de7fc7c0d77050b34e6d06830b20d9e79c4a2723dc01

    • SSDEEP

      6144:hvnLYwrhufUZyoI/t58g/cyS5UkVYj8gE:hvnEwtuf1oGv8gVS5U7w

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks