Overview

overview

10

Static

static

3

23f268a12b...18.exe

windows7-x64

10

23f268a12b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    23f268a12bb600e34964307c62fc7559_JaffaCakes118

  • Size

    385KB

  • Sample

    240329-rc2kzsag37

  • MD5

    23f268a12bb600e34964307c62fc7559

  • SHA1

    6c8b85ea418bbfd53f03c68fe49c29f7c49739d0

  • SHA256

    9ab5d45335d7e33c9432d5dd36ccfaa9098d1c2e91841c655ac9e27be0bfb386

  • SHA512

    381cec920fb848e8e700849b0a3f777e39b68a8a9c25e721dc08468248cc51c04264d79b67e072cc29c5fccee6367dea06f309864f5263f5a2cfe885377e6c19

  • SSDEEP

    6144:8WF4FqAaaXk0g4kNDHUDPjS+WD27/Rv4h+n4UbAbzpVJ/fT0NcPePX:6haYpHkIuDe/Rwsn4UedVJ3wm2X

Score
10/10
redlinesectopratusamoneyinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

usamoney

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      23f268a12bb600e34964307c62fc7559_JaffaCakes118

    • Size

      385KB

    • MD5

      23f268a12bb600e34964307c62fc7559

    • SHA1

      6c8b85ea418bbfd53f03c68fe49c29f7c49739d0

    • SHA256

      9ab5d45335d7e33c9432d5dd36ccfaa9098d1c2e91841c655ac9e27be0bfb386

    • SHA512

      381cec920fb848e8e700849b0a3f777e39b68a8a9c25e721dc08468248cc51c04264d79b67e072cc29c5fccee6367dea06f309864f5263f5a2cfe885377e6c19

    • SSDEEP

      6144:8WF4FqAaaXk0g4kNDHUDPjS+WD27/Rv4h+n4UbAbzpVJ/fT0NcPePX:6haYpHkIuDe/Rwsn4UedVJ3wm2X

    Score
    10/10
    redlinesectopratusamoneyinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks