Overview

overview

10

Static

static

3

2cf307db84...18.exe

windows7-x64

10

2cf307db84...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2cf307db8401038bde6ef17fbeb40f2e_JaffaCakes118

  • Size

    369KB

  • Sample

    240329-z1afeahg7w

  • MD5

    2cf307db8401038bde6ef17fbeb40f2e

  • SHA1

    ae892ecc93fbae5e1a6de3e703de71c8a7e2fbdd

  • SHA256

    fcd6b484d4cd39759b9a7d06c6b3097d133551bdcd4173bc403f0bab1d7365cb

  • SHA512

    d0a4e87f99fc0a188d70f82627cb460429b977240bc8c8c41cb4ad47fa13e3916c976d0ca50230d9214f5956f3888a86d5f0922e8ee05a6f9525f85728c8ddb7

  • SSDEEP

    6144:mmiU4NtBIVh+BRJ+5GEXBn3aJmXlT3YWr+5CzCR8GfukKtS+YIhev:m1Uoq+BRsUEXBn3aJmX93YJ56GfukKth

Score
10/10
redlinesectopratpubinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      2cf307db8401038bde6ef17fbeb40f2e_JaffaCakes118

    • Size

      369KB

    • MD5

      2cf307db8401038bde6ef17fbeb40f2e

    • SHA1

      ae892ecc93fbae5e1a6de3e703de71c8a7e2fbdd

    • SHA256

      fcd6b484d4cd39759b9a7d06c6b3097d133551bdcd4173bc403f0bab1d7365cb

    • SHA512

      d0a4e87f99fc0a188d70f82627cb460429b977240bc8c8c41cb4ad47fa13e3916c976d0ca50230d9214f5956f3888a86d5f0922e8ee05a6f9525f85728c8ddb7

    • SSDEEP

      6144:mmiU4NtBIVh+BRJ+5GEXBn3aJmXlT3YWr+5CzCR8GfukKtS+YIhev:m1Uoq+BRsUEXBn3aJmX93YJ56GfukKth

    Score
    10/10
    redlinesectopratpubinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks