Overview

overview

10

Static

static

3

b789e985d3...18.exe

windows7-x64

10

b789e985d3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b789e985d3c4281c9515433811ea21c2_JaffaCakes118

  • Size

    355KB

  • Sample

    240404-nyerkaeb7w

  • MD5

    b789e985d3c4281c9515433811ea21c2

  • SHA1

    08f5b34f1e19a4659041eec1df587c8036428696

  • SHA256

    552d8d01f02ee396385097544499d26612e11a4cd0381a58c45436ec614ec02b

  • SHA512

    381dfbff5118db7432f8ecdabf5f5fae00bec1da3c30c59a2415748364da6ccfd7364b60cd59a32e7aa3493110510701a0da621ed0e1c983c411f9f83caccb1d

  • SSDEEP

    6144:IAbAYfbpFzgLgESONKgTOrHfziqAOzWJPfqXF:IEAYfbpFzgLbSXNIqF

Score
10/10
redlinesectoprat@silistrii_lztinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

@silistrii_LZT

C2

zellavonela.xyz:80

Attributes
  • auth_value

    584b781c29c4ce798ce009c5b16b2263

Targets

    • Target

      b789e985d3c4281c9515433811ea21c2_JaffaCakes118

    • Size

      355KB

    • MD5

      b789e985d3c4281c9515433811ea21c2

    • SHA1

      08f5b34f1e19a4659041eec1df587c8036428696

    • SHA256

      552d8d01f02ee396385097544499d26612e11a4cd0381a58c45436ec614ec02b

    • SHA512

      381dfbff5118db7432f8ecdabf5f5fae00bec1da3c30c59a2415748364da6ccfd7364b60cd59a32e7aa3493110510701a0da621ed0e1c983c411f9f83caccb1d

    • SSDEEP

      6144:IAbAYfbpFzgLgESONKgTOrHfziqAOzWJPfqXF:IEAYfbpFzgLbSXNIqF

    Score
    10/10
    redlinesectoprat@silistrii_lztinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks