Overview

overview

10

Static

static

3

34123d3384...18.exe

windows7-x64

10

34123d3384...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    34123d3384dcd1437603e79e8ae18822_JaffaCakes118

  • Size

    308KB

  • Sample

    240330-fggwlahh33

  • MD5

    34123d3384dcd1437603e79e8ae18822

  • SHA1

    1de09295975ecdb0c0e565d8481a1111bf6150ed

  • SHA256

    5eb8fdb63af004c8b3f87865e9c8f3480fe0e50b356fefa8eff82b252c7d778f

  • SHA512

    a25bb91005ef0c9578a92ed8bb43cbd0ecd7cacfdb249b5a66bce126ef4b57a01d226bc26d30f8ca435843778244bf9e89b81c452a9c0e6ac99bcbeced719fe4

  • SSDEEP

    6144:ZGCJBkjIMuV5iNElU35vSjec7EGnPVx98aC3X4:Q2Bafe7UJKCKH8no

Score
10/10
redlinesectopratusamoneyinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

usamoney

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      34123d3384dcd1437603e79e8ae18822_JaffaCakes118

    • Size

      308KB

    • MD5

      34123d3384dcd1437603e79e8ae18822

    • SHA1

      1de09295975ecdb0c0e565d8481a1111bf6150ed

    • SHA256

      5eb8fdb63af004c8b3f87865e9c8f3480fe0e50b356fefa8eff82b252c7d778f

    • SHA512

      a25bb91005ef0c9578a92ed8bb43cbd0ecd7cacfdb249b5a66bce126ef4b57a01d226bc26d30f8ca435843778244bf9e89b81c452a9c0e6ac99bcbeced719fe4

    • SSDEEP

      6144:ZGCJBkjIMuV5iNElU35vSjec7EGnPVx98aC3X4:Q2Bafe7UJKCKH8no

    Score
    10/10
    redlinesectopratusamoneyinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks