Overview

overview

10

Static

static

3

6497d56519...18.exe

windows7-x64

10

6497d56519...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6497d565190f4e86e96b66bdd29b97cd_JaffaCakes118

  • Size

    426KB

  • Sample

    240401-cfajcaah65

  • MD5

    6497d565190f4e86e96b66bdd29b97cd

  • SHA1

    87d267d7e420d0192ef64935fe7bcdbbf3f343e2

  • SHA256

    88b4eec1c5be9211e2f65a4b5bd1364bc245b2ab318350f5d671b66764f23964

  • SHA512

    614fa7fffb59567e35762b0bdc4518d2593ac0fe4c8b9702f57424daefd15991c661362c42ec304ba266c329cc9962f7ad737da5efa1aca3d887e2928bb674f9

  • SSDEEP

    12288:eg65vKUysiMhQk+7wYkwPbUuoOb1HtvOmU:165vKUysiMCk+DkXOb1N

Score
10/10
redlinesectopratpaladininfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

37.228.129.48:29795

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      6497d565190f4e86e96b66bdd29b97cd_JaffaCakes118

    • Size

      426KB

    • MD5

      6497d565190f4e86e96b66bdd29b97cd

    • SHA1

      87d267d7e420d0192ef64935fe7bcdbbf3f343e2

    • SHA256

      88b4eec1c5be9211e2f65a4b5bd1364bc245b2ab318350f5d671b66764f23964

    • SHA512

      614fa7fffb59567e35762b0bdc4518d2593ac0fe4c8b9702f57424daefd15991c661362c42ec304ba266c329cc9962f7ad737da5efa1aca3d887e2928bb674f9

    • SSDEEP

      12288:eg65vKUysiMhQk+7wYkwPbUuoOb1HtvOmU:165vKUysiMCk+DkXOb1N

    Score
    10/10
    redlinesectopratpaladininfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks