General

  • Target

    331559f446e2f5b9a675db07ee93a274

  • Size

    95KB

  • Sample

    241110-yzczgavbmb

  • MD5

    331559f446e2f5b9a675db07ee93a274

  • SHA1

    3cc3679f64d7860239d880e45c22680944cda964

  • SHA256

    560f15c0edf202d61a78c0403475ac91603a6415712b8f8fc82797cfd2ef000f

  • SHA512

    08060f616fbb0d9f5ac7a83470fb18936bef1d4b0d059243b0d9f0d98873cadf1ffeeb676e14b737aa727df9f8724418601c6ee0b04917e9508e0598c6998200

  • SSDEEP

    1536:9HqsgEq76ElbG6jejoigIY43Ywzi0Zb78ivombfexv0ujXyyed26tmulgS6pM:91V+68YY+zi0ZbYe1g0ujyzdmM

Malware Config

Extracted

Family

redline

Botnet

BILLYBANKS

C2

7.tcp.eu.ngrok.io:13616

Targets

    • Target

      331559f446e2f5b9a675db07ee93a274

    • Size

      95KB

    • MD5

      331559f446e2f5b9a675db07ee93a274

    • SHA1

      3cc3679f64d7860239d880e45c22680944cda964

    • SHA256

      560f15c0edf202d61a78c0403475ac91603a6415712b8f8fc82797cfd2ef000f

    • SHA512

      08060f616fbb0d9f5ac7a83470fb18936bef1d4b0d059243b0d9f0d98873cadf1ffeeb676e14b737aa727df9f8724418601c6ee0b04917e9508e0598c6998200

    • SSDEEP

      1536:9HqsgEq76ElbG6jejoigIY43Ywzi0Zb78ivombfexv0ujXyyed26tmulgS6pM:91V+68YY+zi0ZbYe1g0ujyzdmM

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks