Overview

overview

10

Static

static

3

0f84d9db43...18.exe

windows7-x64

10

0f84d9db43...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f84d9db43a4289f8cc3e2f215df6bad_JaffaCakes118

  • Size

    308KB

  • Sample

    240328-zhbwhsga8w

  • MD5

    0f84d9db43a4289f8cc3e2f215df6bad

  • SHA1

    3264a33eaf1366a99922b7261b543970588bcaaa

  • SHA256

    563fdba167c80de6ec4e7495a7f040cd4f7998602898039bcdaa00a08ad3b49d

  • SHA512

    42ce242d9b7d93a5d4c7393cb69fa4875b690c3b5c14924cb989cfc0428fbc486e234ecb5fd7aa295b1b6774e024a0e13371334d1c20f7ed8afcd793c11d71d2

  • SSDEEP

    6144:KQCJBkjIUOXqJfXAY+AZc/DI3bJM6I3sBhPVOAndgk8PVx98aC388hI2:H2BaPOXqJfXt+AQI3by93sBhNOAcH8nR

Score
10/10
redlinesectopratusamoneyinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

usamoney

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      0f84d9db43a4289f8cc3e2f215df6bad_JaffaCakes118

    • Size

      308KB

    • MD5

      0f84d9db43a4289f8cc3e2f215df6bad

    • SHA1

      3264a33eaf1366a99922b7261b543970588bcaaa

    • SHA256

      563fdba167c80de6ec4e7495a7f040cd4f7998602898039bcdaa00a08ad3b49d

    • SHA512

      42ce242d9b7d93a5d4c7393cb69fa4875b690c3b5c14924cb989cfc0428fbc486e234ecb5fd7aa295b1b6774e024a0e13371334d1c20f7ed8afcd793c11d71d2

    • SSDEEP

      6144:KQCJBkjIUOXqJfXAY+AZc/DI3bJM6I3sBhPVOAndgk8PVx98aC388hI2:H2BaPOXqJfXt+AQI3by93sBhNOAcH8nR

    Score
    10/10
    redlinesectopratusamoneyinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks