Overview

overview

10

Static

static

3

6621d05f87...18.exe

windows7-x64

10

6621d05f87...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6621d05f87c325c58a71d0b3b1550440_JaffaCakes118

  • Size

    366KB

  • Sample

    240401-drywracb4w

  • MD5

    6621d05f87c325c58a71d0b3b1550440

  • SHA1

    cfbe4441457dc12b2be09a5c5ab72528b001339e

  • SHA256

    b06a0f9d82017f854001045076cf7141f3e70994ea07ee36633edb6b86c5b80f

  • SHA512

    00cde6fe4ffab239be47e9759dd02d57614d56745ab492f2b4ce72e1fa32bec009234026e7c67b0b04cf18a165932b178b098bb0410a947ed007efcad49e4b6a

  • SSDEEP

    6144:nP07exOUCWj6hFHs/ueY82JuNWKs6/Kwhelce6pbcXuu+g:sCx7C1FqueogAKs6/KNlceeMuRg

Score
10/10
redlinesectopratsewpalpinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

sewPalp

C2

185.215.113.29:24645

Attributes
  • auth_value

    41d3df6d093b1e36993abf16af0d6f2d

Targets

    • Target

      6621d05f87c325c58a71d0b3b1550440_JaffaCakes118

    • Size

      366KB

    • MD5

      6621d05f87c325c58a71d0b3b1550440

    • SHA1

      cfbe4441457dc12b2be09a5c5ab72528b001339e

    • SHA256

      b06a0f9d82017f854001045076cf7141f3e70994ea07ee36633edb6b86c5b80f

    • SHA512

      00cde6fe4ffab239be47e9759dd02d57614d56745ab492f2b4ce72e1fa32bec009234026e7c67b0b04cf18a165932b178b098bb0410a947ed007efcad49e4b6a

    • SSDEEP

      6144:nP07exOUCWj6hFHs/ueY82JuNWKs6/Kwhelce6pbcXuu+g:sCx7C1FqueogAKs6/KNlceeMuRg

    Score
    10/10
    redlinesectopratsewpalpinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks