General

  • Target

    dafd344406f9e3a55938dcb584834b2b103a4550d571559071ece00811796864

  • Size

    265KB

  • Sample

    241110-t37wsszmh1

  • MD5

    30c732044ea09f221be9b1d176057cd4

  • SHA1

    a020eb13eadac958d76c7713efb8143cf35730cf

  • SHA256

    dafd344406f9e3a55938dcb584834b2b103a4550d571559071ece00811796864

  • SHA512

    7ab3cd92c8a6d98aff85c96b1c72bb7c7215fef4fe4e3dc2d92a273ec9385d4316e1fbc440bc3d48c3bc517d0412e72dbeeda42f9555df3eea4d063b6dfb37bc

  • SSDEEP

    6144:8vnLYKUnDb9odH76WfQvw8GHrrRgng+z0xJg:8vnEHnVodmrAHRLg0Y

Malware Config

Extracted

Family

redline

Botnet

installbot_mix2

C2

185.118.165.94:15838

Targets

    • Target

      dafd344406f9e3a55938dcb584834b2b103a4550d571559071ece00811796864

    • Size

      265KB

    • MD5

      30c732044ea09f221be9b1d176057cd4

    • SHA1

      a020eb13eadac958d76c7713efb8143cf35730cf

    • SHA256

      dafd344406f9e3a55938dcb584834b2b103a4550d571559071ece00811796864

    • SHA512

      7ab3cd92c8a6d98aff85c96b1c72bb7c7215fef4fe4e3dc2d92a273ec9385d4316e1fbc440bc3d48c3bc517d0412e72dbeeda42f9555df3eea4d063b6dfb37bc

    • SSDEEP

      6144:8vnLYKUnDb9odH76WfQvw8GHrrRgng+z0xJg:8vnEHnVodmrAHRLg0Y

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks