Overview

overview

10

Static

static

3

b321ac1d90...18.exe

windows7-x64

10

b321ac1d90...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b321ac1d90fb1f6bd5671b2ab0601c94_JaffaCakes118

  • Size

    449KB

  • Sample

    240404-j1jfbaae89

  • MD5

    b321ac1d90fb1f6bd5671b2ab0601c94

  • SHA1

    dd9003b3b764bb717e2846ba7695aa4d438aae34

  • SHA256

    24548102a0bde6de1a12ea22af035a921852327d9670643abdc6d8594ca415c4

  • SHA512

    debad3f369c5776b3e47d0273b1aee861c9fdee622c0bee4901a700873945bc682f21190cd037e68ca5ca1bf33baeac02084b131c53fee3100340993fa789585

  • SSDEEP

    12288:VyupeeuuluF/tTbnVwIiM+s0LpH8pPZP+9xZ:Vn7bitfVwIr0LpGZ

Score
10/10
redlinesectopratpaladininfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

178.63.26.132:29795

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      b321ac1d90fb1f6bd5671b2ab0601c94_JaffaCakes118

    • Size

      449KB

    • MD5

      b321ac1d90fb1f6bd5671b2ab0601c94

    • SHA1

      dd9003b3b764bb717e2846ba7695aa4d438aae34

    • SHA256

      24548102a0bde6de1a12ea22af035a921852327d9670643abdc6d8594ca415c4

    • SHA512

      debad3f369c5776b3e47d0273b1aee861c9fdee622c0bee4901a700873945bc682f21190cd037e68ca5ca1bf33baeac02084b131c53fee3100340993fa789585

    • SSDEEP

      12288:VyupeeuuluF/tTbnVwIiM+s0LpH8pPZP+9xZ:Vn7bitfVwIr0LpGZ

    Score
    10/10
    redlinesectopratpaladininfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks