General

  • Target

    495565a799521b9654bc523eef81b84f13e22631ca36e65ba0612cb771fec279

  • Size

    224KB

  • Sample

    241111-fbhkyatcne

  • MD5

    0eb22a6fbf9c98a34b1694965ba0a361

  • SHA1

    007d445cddcfb1d2e89d159f52c277ea1b62caa1

  • SHA256

    495565a799521b9654bc523eef81b84f13e22631ca36e65ba0612cb771fec279

  • SHA512

    e28c352438eae4ecd87da2036f4c0f1cd35f724ea175d7d9d0c2b7e821b935658a15ef883c6961be49f15168ee22a702bee77d4d840337e1579eaf012c17a483

  • SSDEEP

    6144:5vnLYHsuhdIHU9s+RRnvnCBEyOLzBI30s7S40appI:5vnEcHUJV6BR8zBBsH

Malware Config

Extracted

Family

redline

Botnet

installbot_mix2

C2

185.118.165.94:15838

Targets

    • Target

      495565a799521b9654bc523eef81b84f13e22631ca36e65ba0612cb771fec279

    • Size

      224KB

    • MD5

      0eb22a6fbf9c98a34b1694965ba0a361

    • SHA1

      007d445cddcfb1d2e89d159f52c277ea1b62caa1

    • SHA256

      495565a799521b9654bc523eef81b84f13e22631ca36e65ba0612cb771fec279

    • SHA512

      e28c352438eae4ecd87da2036f4c0f1cd35f724ea175d7d9d0c2b7e821b935658a15ef883c6961be49f15168ee22a702bee77d4d840337e1579eaf012c17a483

    • SSDEEP

      6144:5vnLYHsuhdIHU9s+RRnvnCBEyOLzBI30s7S40appI:5vnEcHUJV6BR8zBBsH

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks