redline | aa380d5239ccf0409993f7cfb4c2345d2364f3795398de00ea5b2db86e9a2cbb

Analysis

max time kernel
141s
max time network
149s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 22:40

Target

c39f7d21aabffec2e14e7484ed6afe03_JaffaCakes118.exe
Size

366KB
MD5

c39f7d21aabffec2e14e7484ed6afe03
SHA1

ebc0316b53f68ee2f71d9c07aaf10436d9401816
SHA256

aa380d5239ccf0409993f7cfb4c2345d2364f3795398de00ea5b2db86e9a2cbb
SHA512

bf3877a6888bc08cf7be11f0ba7385d5c9f8c188bb89cd2194a9a7f8d2c5c46385a87433258e987cd3f42a4c67930f41463c88cacdd50db374e163b8463bc1ba
SSDEEP

6144:/+1fYzo2YFtv7XfkLR55Q+ONHlyj/tftlyooBg7eV:Gn9v7XcV5G+Odlyj/tDyoom2

Score

10^/10

Family

redline

Botnet

shop

45.9.20.107:46187

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1668-5-0x00000000019E0000-0x0000000001A04000-memory.dmp	family_redline
behavioral1/memory/1668-8-0x00000000033B0000-0x00000000033D2000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1668-5-0x00000000019E0000-0x0000000001A04000-memory.dmp	family_sectoprat
behavioral1/memory/1668-8-0x00000000033B0000-0x00000000033D2000-memory.dmp	family_sectoprat

C:\Users\Admin\AppData\Local\Temp\c39f7d21aabffec2e14e7484ed6afe03_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c39f7d21aabffec2e14e7484ed6afe03_JaffaCakes118.exe"
1⤵
PID:1668

memory/1668-1-0x00000000017E0000-0x00000000018E0000-memory.dmp

Filesize
1024KB

Download
memory/1668-2-0x0000000000400000-0x00000000016CF000-memory.dmp

Filesize
18.8MB

Download
memory/1668-3-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/1668-4-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/1668-5-0x00000000019E0000-0x0000000001A04000-memory.dmp

Filesize
144KB

Download
memory/1668-6-0x0000000005AC0000-0x0000000005B00000-memory.dmp

Filesize
256KB

Download
memory/1668-7-0x0000000005AC0000-0x0000000005B00000-memory.dmp

Filesize
256KB

Download
memory/1668-8-0x00000000033B0000-0x00000000033D2000-memory.dmp

Filesize
136KB

Download
memory/1668-9-0x0000000005AC0000-0x0000000005B00000-memory.dmp

Filesize
256KB

Download
memory/1668-11-0x00000000017E0000-0x00000000018E0000-memory.dmp

Filesize
1024KB

Download
memory/1668-12-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/1668-14-0x0000000005AC0000-0x0000000005B00000-memory.dmp

Filesize
256KB

Download