Overview

overview

10

Static

static

3

382b771687...18.exe

windows7-x64

10

382b771687...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    382b7716875875620107caaf8e9597df_JaffaCakes118

  • Size

    426KB

  • Sample

    240330-kg12pace56

  • MD5

    382b7716875875620107caaf8e9597df

  • SHA1

    e6d3cc251924040f4cc360f46856d4326f58b185

  • SHA256

    8cf4c1ab24e4252d64b12600f742f15d59ab4e6a8f3d61e774ceace77ec29cd2

  • SHA512

    4334d4c1e627b94955be3f74a6d70df41a3d9e94cf930ca7756e013725877c6d01090e655bdb484ebd904e4e13dd127f94c8ba7a98490104cd36aa3baaca912a

  • SSDEEP

    12288:ovukkblq4FoDJx6pCWeyUxQ5cPgUZTWt:kwvFSJOCq5cPt

Score
10/10
redlinesectopratpaladininfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

37.228.129.48:29795

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      382b7716875875620107caaf8e9597df_JaffaCakes118

    • Size

      426KB

    • MD5

      382b7716875875620107caaf8e9597df

    • SHA1

      e6d3cc251924040f4cc360f46856d4326f58b185

    • SHA256

      8cf4c1ab24e4252d64b12600f742f15d59ab4e6a8f3d61e774ceace77ec29cd2

    • SHA512

      4334d4c1e627b94955be3f74a6d70df41a3d9e94cf930ca7756e013725877c6d01090e655bdb484ebd904e4e13dd127f94c8ba7a98490104cd36aa3baaca912a

    • SSDEEP

      12288:ovukkblq4FoDJx6pCWeyUxQ5cPgUZTWt:kwvFSJOCq5cPt

    Score
    10/10
    redlinesectopratpaladininfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks