Overview

overview

10

Static

static

3

91352fa35e...18.exe

windows7-x64

10

91352fa35e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    91352fa35eaeb5a4e2f79561352505b5_JaffaCakes118

  • Size

    277KB

  • Sample

    240402-trsmqsfa8w

  • MD5

    91352fa35eaeb5a4e2f79561352505b5

  • SHA1

    9dbe2c4559e0b6907897c3fb773c02b8fe4bf57e

  • SHA256

    c406c0b632f53da9dda00cb1114c086c099ac059b37a64d6cad6b64e7e096300

  • SHA512

    885e993634519cd4a1e5cfc8f43a9bc79494d27d04d0b3eeb5716806a7e5b804a1705cfc1db14c6b852c606d307dbc374d85095d6e9a63dd4730293fcd962a0e

  • SSDEEP

    6144:E3yy46DKB4tHKhVF2zTI+IkTm3r7Vx98aCd+vIyE:ry40K772Pnnm1H8t+

Score
10/10
redlinesectopratusamoneyinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

usamoney

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      91352fa35eaeb5a4e2f79561352505b5_JaffaCakes118

    • Size

      277KB

    • MD5

      91352fa35eaeb5a4e2f79561352505b5

    • SHA1

      9dbe2c4559e0b6907897c3fb773c02b8fe4bf57e

    • SHA256

      c406c0b632f53da9dda00cb1114c086c099ac059b37a64d6cad6b64e7e096300

    • SHA512

      885e993634519cd4a1e5cfc8f43a9bc79494d27d04d0b3eeb5716806a7e5b804a1705cfc1db14c6b852c606d307dbc374d85095d6e9a63dd4730293fcd962a0e

    • SSDEEP

      6144:E3yy46DKB4tHKhVF2zTI+IkTm3r7Vx98aCd+vIyE:ry40K772Pnnm1H8t+

    Score
    10/10
    redlinesectopratusamoneyinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks