General

  • Target

    0259e8998429082c62e0925581532c4d6c9a54fe500a992159ba0ce050fcc729

  • Size

    224KB

  • Sample

    241110-llxeqsvblc

  • MD5

    957ce301d74f211fa8cc1b5756cf9903

  • SHA1

    07ce03ba0ce5333b0650ff38d0630182948c328d

  • SHA256

    0259e8998429082c62e0925581532c4d6c9a54fe500a992159ba0ce050fcc729

  • SHA512

    cde8b8717d2c28312e4e90e0cf73c304fb79398d7cc9876e725c0fc36198327d877bbd772133cfe53743746d34061636aa25723459ecca5ac683efdfe10a82b3

  • SSDEEP

    3072:UOuvnLYJF1RRB4SldjwmDujboLuCPeEbI3V/h5CzWgelGl6JaAZG56Z:kvnLYn1JjjwmDrPeEb6p5+aWA

Malware Config

Extracted

Family

redline

Botnet

installbot_mix2

C2

185.118.165.94:15838

Targets

    • Target

      0259e8998429082c62e0925581532c4d6c9a54fe500a992159ba0ce050fcc729

    • Size

      224KB

    • MD5

      957ce301d74f211fa8cc1b5756cf9903

    • SHA1

      07ce03ba0ce5333b0650ff38d0630182948c328d

    • SHA256

      0259e8998429082c62e0925581532c4d6c9a54fe500a992159ba0ce050fcc729

    • SHA512

      cde8b8717d2c28312e4e90e0cf73c304fb79398d7cc9876e725c0fc36198327d877bbd772133cfe53743746d34061636aa25723459ecca5ac683efdfe10a82b3

    • SSDEEP

      3072:UOuvnLYJF1RRB4SldjwmDujboLuCPeEbI3V/h5CzWgelGl6JaAZG56Z:kvnLYn1JjjwmDrPeEb6p5+aWA

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks