Overview

overview

10

Static

static

3

161c1e9b2b...18.exe

windows7-x64

10

161c1e9b2b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    161c1e9b2be7a7f15ef5d5944f60a7ad_JaffaCakes118

  • Size

    385KB

  • Sample

    240329-ctpkesff83

  • MD5

    161c1e9b2be7a7f15ef5d5944f60a7ad

  • SHA1

    5916429f529847ba6f91e1b15d1ce14dcc3b86b0

  • SHA256

    1569ab96dc22cc20538d37f8dc3e1c8ce0e62ae3968f9b3b5d8442864640ca1f

  • SHA512

    b933c4a06a1e8a418591b399e30bb8cc093d0bd90f41e2093dd50bcc4fd3801ef15d4dc812362826d207fd262e81bec9a177e0d694e464bb5f7486ba9eed38e0

  • SSDEEP

    6144:RY3Y74ZLH0Q75NSA9VtGa67iKfjRiCcOJRRJeV0z2sDsoYR:r8Z08IAztGa67i81iCcOJRRZ2sDsJ

Score
10/10
redlinesectopratsewpalpinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

sewPalp

C2

185.215.113.29:24645

Attributes
  • auth_value

    41d3df6d093b1e36993abf16af0d6f2d

Targets

    • Target

      161c1e9b2be7a7f15ef5d5944f60a7ad_JaffaCakes118

    • Size

      385KB

    • MD5

      161c1e9b2be7a7f15ef5d5944f60a7ad

    • SHA1

      5916429f529847ba6f91e1b15d1ce14dcc3b86b0

    • SHA256

      1569ab96dc22cc20538d37f8dc3e1c8ce0e62ae3968f9b3b5d8442864640ca1f

    • SHA512

      b933c4a06a1e8a418591b399e30bb8cc093d0bd90f41e2093dd50bcc4fd3801ef15d4dc812362826d207fd262e81bec9a177e0d694e464bb5f7486ba9eed38e0

    • SSDEEP

      6144:RY3Y74ZLH0Q75NSA9VtGa67iKfjRiCcOJRRJeV0z2sDsoYR:r8Z08IAztGa67i81iCcOJRRZ2sDsJ

    Score
    10/10
    redlinesectopratsewpalpinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks