General

  • Target

    bc1ac6168bd80c5e01ddacab6e3afbea0b5ffa76eed3799b80a2fb0f39eb38b3

  • Size

    6.4MB

  • Sample

    241111-ecb9wavrfn

  • MD5

    b6131e643fdc6d02486b66048bf29c77

  • SHA1

    2efd8a02bcf449f0ba52fb753f9ec8860a411b27

  • SHA256

    bc1ac6168bd80c5e01ddacab6e3afbea0b5ffa76eed3799b80a2fb0f39eb38b3

  • SHA512

    fbcd7d86f089abe53cc836d63ce4369766850d320e03b4c5e4a1f3f89ecfc1f1bf36ed6cecf24a92b6126fa3ca93fb36fc514c160051cc15edc724fa2eef6ea2

  • SSDEEP

    196608:sSeMv0pJBhLyqVAeWauD/aAtpSv1dBY0gScxb:sj3JB1DVAexAmn9/cxb

Malware Config

Extracted

Family

redline

Botnet

installbot_mix2

C2

185.118.165.94:15838

Targets

    • Target

      mixazed_20210807-100229

    • Size

      289KB

    • MD5

      e646dd94d43f9b8c014a2ff27bac76d6

    • SHA1

      4b8888f5425cbc78ee71a8176922871b35a13e8e

    • SHA256

      dd2edade9580b926d918439cf1dffa70de1e27bcc592dd805a147cf946e61317

    • SHA512

      81ec3241bbf2511a2b758da16fcedb0972b91da2da528a68faba909b54991c0e7ed3f1c6594dba17ccc6a654bc0d6927221fb1eb8ce47e960f22caed459e4f5c

    • SSDEEP

      6144:MjxLgQPuFhqbOsFbI2BP+i9SoV8trRgGajTwa/RxJg:MjxEQPE2IUWgsR8Y

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-101809

    • Size

      289KB

    • MD5

      6d6eaef400e5bb67b8e843f046248143

    • SHA1

      0b539021023e8eb15c8cc76d29cde55c0c114ca1

    • SHA256

      d084651fa8bcb6ca12ba8ae5a14ae3b72d04e299dfd11743ccade2c1ee9ae49e

    • SHA512

      6301a39013ca77df98d8781588cca5aa50434e8dd3d753faeb7d2e94aa85fab69e1ff8a329d53d033a85a5c6695f7b5424b846aeffcc2b703905529ec5b43137

    • SSDEEP

      6144:BQ9L1ClJw+okcbo2wvL8i2oWmUrRg3jTwa/RxJg:BQ95f+gRwT8i2ogRsY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-103350

    • Size

      289KB

    • MD5

      c605159491bb0a9bbf571186135802a6

    • SHA1

      4712e7b000f2e6e1fc79a17f64b13a15d2db0f7c

    • SHA256

      43135b39029b35e3bb98332bad9c1a56b123ca9a310e2ee557efe8943e03c517

    • SHA512

      4d1c0bb8cccecdfbc35563c720d8295c788f0d8e2d04646ad64bc1c212cc267fc503f483a75d56fd90d58839c3f5b7aa2834e9d48dccb9823253f35a21c1894d

    • SSDEEP

      6144:vQ9L10/9UhG/lpoj8X7I4Yeoy2rRgsjTwa/RxJg:vQ95XhGty2IBUgR1Y

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-104930

    • Size

      289KB

    • MD5

      e05f273e27b6674d68faf7ca52cb7433

    • SHA1

      949db9c3d2249d3a19ffc00b83be6aebd7bf111f

    • SHA256

      4febcc3f4d6fa3da1fca57adbc312f73dc28b02f38053d9ecf0fbd11dea9ffbd

    • SHA512

      4c68657d95bd2017a1f4f96f170ccd2498b9b890759710081e3b5077a1e97e5e2c5996839d4707f2d3c5c2abb063202c921bf8ade8fe35ed9dab9493553fc7ac

    • SSDEEP

      6144:MQ9L1yqJ7VdhI1SjLSanCQjfHiWJ4hk1rRggjTwa/RxJg:MQ95BbhSSaanzjviW1NRZY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-110511

    • Size

      289KB

    • MD5

      b72408a0448292dd7c3499026123b74c

    • SHA1

      8ac7107b980406cb177c0a4c9a0d5d83c6949ba7

    • SHA256

      51b6fbf00ed0e2c5aed555342defc72cec4b4123fa9eb469b4ef61058721faa6

    • SHA512

      08ea04055ea6ebbb44f611f3ea6165d15a241cfd5f2919ddeb7fd2e2142cf14afc3a37a804c488449a3bcbfbb0747bc4e443a99a72f6aca68ccc392366706cd4

    • SSDEEP

      6144:nQ9L1dOmcLIVc70Bs/B3DBirRgoFAjTwa/RxJg:nQ95dOmcoc70Bs/B1kRDqY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-112051

    • Size

      290KB

    • MD5

      aabbe896cea4103936b820333f926a57

    • SHA1

      906e6e149978c57bad8ad934c4a8aaec87a99334

    • SHA256

      2fbac76729ee160fe8f4d7a6349ea0d06f7ef48c9483136b2c09302d30c032d4

    • SHA512

      e005072ffd622bd6d34ea1f216aa5744baaff6b8cd206027ee6dd8619b2917314ab4e4df549de59ba1a2fc077d3ad83931e769765cb64dabcb47864c95ce1e17

    • SSDEEP

      6144:AQ9L11tFsjmMwk2WBsrRg1wmHuejTwa/RxJg:AQ9518GWByR4NY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-113631

    • Size

      289KB

    • MD5

      5b60b7b97ec5523314d35ca1e7942859

    • SHA1

      f6614678a5f801ca679ac8d5e70bce98f20af605

    • SHA256

      8d26b2ae7ca990129742fbf39a8049da00ba929d26bbd3781bc4b3482aad2897

    • SHA512

      f50c893241ea49640c364937197b390ed9ee5c98dd4c0c09e7cd6c02cd7b9250d7bb7e2750876d1cf6f1ecc222f976f657c92ba6ce9c036383cd4ba01faaae24

    • SSDEEP

      6144:gKtLe7pWsgm8x+k3Pa3C78ZrRgm7jTwa/RxJg:gKtK7EJm8x+k3C3C7+RXY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-115211

    • Size

      289KB

    • MD5

      7da6c851fd37a063d0376d17187aafc1

    • SHA1

      5d6fdfb129f023c99340f13619af55d32bdf9919

    • SHA256

      1d6e7423f465f108cc793629ae22d9ba284d4553c1b11cf1acddc8c753532a9d

    • SHA512

      e74110e7eeb96703b73fcfa18a46e31f855c5ac3650767b896ab96eb5624dc76884004be15862d60ec613b1132208ff89858013d1f23cbd21f1f67e007bd3d42

    • SSDEEP

      6144:KKtLeRnzJG0Q0Luy4ze2BZY4ARopEwVqrRghjTwa/RxJg:KKtKRnFGh0LsZYXOEtROY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-120751

    • Size

      289KB

    • MD5

      99632bbcca3b1d0a5358cc1572860129

    • SHA1

      182901a790489d2eddcfee8d045edd2ff61dbad8

    • SHA256

      2b2fc9d813df15934157843643ec3f700a5c4be647f02d23f13c9eb0ab298b45

    • SHA512

      5af2c50fdd01a9bae943d46b947ec80052e4faa874466c0ba8b1b7d696511b67780db76a3d9b73a484677077914814f0ca5ffba337faaf003dcbcf0ff9054e5d

    • SSDEEP

      6144:lKtLeEUUB8loFI7ylFknUmK5KQHHrRglTA5gjTwa/RxJg:lKtKEjioFsAFpPHLROk5cY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-122331

    • Size

      289KB

    • MD5

      345ea45534a30aa92a8ad842ad663e68

    • SHA1

      197a004470637baf3e790b4a65ee485407a0db33

    • SHA256

      3b57206f8b2b33b509d269705ded52bf19e00478b3350144ddff52d40f01c7c8

    • SHA512

      8afd613f16ec486189455c09b98bc0d01d1a2032e445e05b2933eb4c9054d89deb5f7ad02f882cd2be19b2d7119719b803c293dbd0ed27df31d5e664cafb658d

    • SSDEEP

      6144:vKtLe5Vpv1XD4eBT8BErRg7v/jTwa/RxJg:vKtK5VnXD5Ts6RQvlY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-123910

    • Size

      289KB

    • MD5

      f3404a65b99657c31ed5d53cba079fd2

    • SHA1

      3b63b01a626fbb96a6c8e691b66bbf1d3bef7dee

    • SHA256

      1e6b77cacc4dd59069dae89a325bdbab2831ed63bddefc5c8d1223550ab1b3bd

    • SHA512

      8005f72053e71ee83a15d05e12c935a8b9a8ce0cdcd6f1a8dbee29eef1b7bb80cccc640643391cfe47456ae292538bd686565a594faf83143a3527cdc2409e33

    • SSDEEP

      6144:uKtLebXlhjEcp4mEWXLjCUl1Pf/8rRgn+XYjTwa/RxJg:uKtKDQcHpLmUl9f/iRJUY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-125449

    • Size

      290KB

    • MD5

      ec258a13a4dc52b9f0d8ccfd244a7967

    • SHA1

      cf5bb39744714e07125e66072ca2c6b7f65d6b5e

    • SHA256

      ea2cce96be02acf0b9a5928110843f5ccb86fec911ee7e80cde8d8200bb3499c

    • SHA512

      26da8bfb90a33fa586de6cf07397b5c20a886272c860a46c9525a3c98adf8b745cd0266a441e9187dd34e62c5453a14a8759ddb2dc83386f6a2d06f6c4bba65e

    • SSDEEP

      6144:NKtLebKi6QtpQrcKDtBXo9rEIrRggjjTwa/RxJg:NKtKd6QknDerEGRJY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-131030

    • Size

      289KB

    • MD5

      6011c1820a9984fdb5ae8ec30ed0e993

    • SHA1

      07648d2263809d5ded65960e7b603e9f84b84743

    • SHA256

      7739ef312d5b771888624c3cc3c104ee422052e8b47fb0613ab2aeef351796f8

    • SHA512

      bba273d01813fbb7130e391054f56ab7407d46e80604394303b04b6e4228ef55000191a9e34384614dd744176ab40d5fa6e6d7e774378abdb6a5435888f0d179

    • SSDEEP

      6144:ozrLB1Bj6cUMi74fUNU9RhDhqQMlrRgVshKijTwa/RxJg:ozrtycqALtEQMdRSsHY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-132610

    • Size

      289KB

    • MD5

      4bb993ebb08cf769624ba523863fc6f5

    • SHA1

      9c7f24776e5a214eed924be22388c141ea7ec0f8

    • SHA256

      1a193c168ac747f69f8979d5463b91ff05340b9faba3cd023e02505c7f2a07bd

    • SHA512

      a62f81a5d0b6924767859867247e0167fa5efd86aea48b10b26f34cb2edb88bcfaedc975788d1a223c07ac3c8b9c4f682ace2b23899ec22e18c808e74db215d2

    • SSDEEP

      6144:JzrLB8eHiISX385PIHrGpIbkSOXtrRgf4CjTwa/RxJg:Jzrt3Hiy5PIHrjpOFRiY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-134151

    • Size

      289KB

    • MD5

      fa547a90c3031bd7fc45656ce378ab2f

    • SHA1

      982fdb7c7d3f49ea6731332cae4123c65e19c83c

    • SHA256

      c06aa04b7b04974f797b6be435cd85d3b4bcf0de1ad2371b77404880dc458a42

    • SHA512

      97dbe0c26664d65630288cd0e211a2d29da6ce76b848ef7d17d41486520c4e3d99057e96ade33e516009c2ef59814b4cbe531d68ededb2b22a7266d7b411406b

    • SSDEEP

      6144:nLpkBHmPzjxn+ZDzzcXUSToxFirRgVrjTwa/RxJg:nVkkdmQXUX4RiY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Target

      mixazed_20210807-135732

    • Size

      290KB

    • MD5

      3eea13c7293bf1d17c6fd2debae3c14f

    • SHA1

      ba127aeea8585ffc83ab96c809e29b18a33c451a

    • SHA256

      b34a57431f7ae9b16f585b5a8520ee299d1588589fadb7340c8f09ad7ad24d00

    • SHA512

      4a6f6856870f9b63d44250e884bcacadf8671d9b4c52437d001dc273bcd9a65705ebe95c5d8283474bd4fe98aae8cae4bc72d2814b9dadbe22a057ffd94148c1

    • SSDEEP

      6144:lLbIeOmcsOYo2OuUmOXJwvN7rRgahjTwa/RxJg:lXI/slo1uGXJwvZRvXY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral2

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral3

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral4

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral5

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral6

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral7

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral8

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral9

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral10

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral11

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral12

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral13

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral14

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral15

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral16

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral17

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral18

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral19

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral20

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral21

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral22

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral23

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral24

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral25

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral26

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral27

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral28

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral29

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral30

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral31

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10

behavioral32

redlinesectopratinstallbot_mix2discoveryinfostealerrattrojan
Score
10/10