Overview

overview

10

Static

static

3

50b2236969...18.exe

windows7-x64

10

50b2236969...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    50b223696961a46e3f435c226b12f899_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240331-jdhv9sgf52

  • MD5

    50b223696961a46e3f435c226b12f899

  • SHA1

    f7e909e182969bdb44c3ed8c2c091967c54c7957

  • SHA256

    658c50b49af49975e3a4bc1fa44337bb72dcf86b49dee68b2fa6e6dd353309b5

  • SHA512

    b19377b68de8d62f5bc85bc523e22b98665a163a3553ba1acafdf068957a123877118698628034c0062c1370ea012c2bbf30175f06ada2e3d5181ad6233d8c36

  • SSDEEP

    24576:2oimILHE5B5qhuefzVHQYZVPL5n1Svs2vr+uFm3rJKDR:2bLMB4ZrlZ/TZGvyAmbJK

Score
10/10
redlinesectopratsapphireinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

sapphire

C2

185.230.143.237:2548

Targets

    • Target

      50b223696961a46e3f435c226b12f899_JaffaCakes118

    • Size

      1.1MB

    • MD5

      50b223696961a46e3f435c226b12f899

    • SHA1

      f7e909e182969bdb44c3ed8c2c091967c54c7957

    • SHA256

      658c50b49af49975e3a4bc1fa44337bb72dcf86b49dee68b2fa6e6dd353309b5

    • SHA512

      b19377b68de8d62f5bc85bc523e22b98665a163a3553ba1acafdf068957a123877118698628034c0062c1370ea012c2bbf30175f06ada2e3d5181ad6233d8c36

    • SSDEEP

      24576:2oimILHE5B5qhuefzVHQYZVPL5n1Svs2vr+uFm3rJKDR:2bLMB4ZrlZ/TZGvyAmbJK

    Score
    10/10
    redlinesectopratsapphireinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks