General

  • Target

    d07821f6b17cd89b9a359f3f6a0776ccec5b2d14078b3f2536c111942584d165N.exe

  • Size

    113KB

  • Sample

    241130-sl31vaxjey

  • MD5

    c03fabc13d7e451aa7789a9e809ee360

  • SHA1

    15c0e7bb586c799eaa5ad185958ab36073da0c2d

  • SHA256

    d07821f6b17cd89b9a359f3f6a0776ccec5b2d14078b3f2536c111942584d165

  • SHA512

    ea8dc64723d98e373279f7c766b5965233e5a4ff9ca4b407d616f73ec4eb8ff79354fe94b3898192673354a914ee2110647c4e8bb355cf05a7e4a2452ab31ce2

  • SSDEEP

    1536:+Vjdb2mf9eCUJkwS9Xyz5SJkyhbMuL69gFvyTFdeFYPrzGEiZ/r:+lddFeC/9Xy1yJS9g1ypOuHBk/r

Malware Config

Extracted

Family

redline

Botnet

ROBLOX_HACK_BY_RUBIKON24

C2

185.215.113.71:16254

Attributes
  • auth_value

    38b425e6d36d640ba20ef1488613e806

Targets

    • Target

      d07821f6b17cd89b9a359f3f6a0776ccec5b2d14078b3f2536c111942584d165N.exe

    • Size

      113KB

    • MD5

      c03fabc13d7e451aa7789a9e809ee360

    • SHA1

      15c0e7bb586c799eaa5ad185958ab36073da0c2d

    • SHA256

      d07821f6b17cd89b9a359f3f6a0776ccec5b2d14078b3f2536c111942584d165

    • SHA512

      ea8dc64723d98e373279f7c766b5965233e5a4ff9ca4b407d616f73ec4eb8ff79354fe94b3898192673354a914ee2110647c4e8bb355cf05a7e4a2452ab31ce2

    • SSDEEP

      1536:+Vjdb2mf9eCUJkwS9Xyz5SJkyhbMuL69gFvyTFdeFYPrzGEiZ/r:+lddFeC/9Xy1yJS9g1ypOuHBk/r

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks