General

  • Target

    e4a144fc22ba4df72a3dc32d5ada46f1fc90d7a7352222fead3ec778d49d279a

  • Size

    277KB

  • Sample

    241109-lqjpfascnr

  • MD5

    4fff8a0f72e9baaa3d4ace94e20ceda0

  • SHA1

    146cc730b00dc8824e2444c08c19860532826227

  • SHA256

    e4a144fc22ba4df72a3dc32d5ada46f1fc90d7a7352222fead3ec778d49d279a

  • SHA512

    007c6049f6f717a34775a247cda1b00e8f588e8fe6fefde4bbf4300b328410b9ee5b49f1e4371696436d254a60b08c6e0cfaa9a0e0c14964fc878c245368add9

  • SSDEEP

    6144:XbS6b/SUr1sutzZO0OYNje8QA6vP1rRgSbxJg:XbdrWuZO0ORFAwVRhY

Malware Config

Extracted

Family

redline

Botnet

installbot_mix2

C2

185.118.165.94:15838

Targets

    • Target

      e4a144fc22ba4df72a3dc32d5ada46f1fc90d7a7352222fead3ec778d49d279a

    • Size

      277KB

    • MD5

      4fff8a0f72e9baaa3d4ace94e20ceda0

    • SHA1

      146cc730b00dc8824e2444c08c19860532826227

    • SHA256

      e4a144fc22ba4df72a3dc32d5ada46f1fc90d7a7352222fead3ec778d49d279a

    • SHA512

      007c6049f6f717a34775a247cda1b00e8f588e8fe6fefde4bbf4300b328410b9ee5b49f1e4371696436d254a60b08c6e0cfaa9a0e0c14964fc878c245368add9

    • SSDEEP

      6144:XbS6b/SUr1sutzZO0OYNje8QA6vP1rRgSbxJg:XbdrWuZO0ORFAwVRhY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks