Overview

overview

10

Static

static

3

baf367bf5b...18.exe

windows7-x64

10

baf367bf5b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    baf367bf5b5c5958ba3c89223361e892_JaffaCakes118

  • Size

    406KB

  • Sample

    240404-r166daad6w

  • MD5

    baf367bf5b5c5958ba3c89223361e892

  • SHA1

    743b4954c6f9d366ac494890e2f224c3f92e87cd

  • SHA256

    bff2d0358b6b5cce52c454ba58b74a5791ee5cb1980adc24ca1a6e540c2b85f9

  • SHA512

    2cad5e30cd676903f9a08cb40e745b75feb93c37d8b14ea945fe5d91821b59cf65c0fa87726a3b62b67aaa37dd3ca986d8517c1cd6179407491c2f54bb343cc9

  • SSDEEP

    12288:MJGT1fRo0AoELtG+BmjwHr/CQIadQXxe1iE99aWw:MJGZfRoj/Q+Bm0DCZxe1iED

Score
10/10
redlinesectopratutsinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      baf367bf5b5c5958ba3c89223361e892_JaffaCakes118

    • Size

      406KB

    • MD5

      baf367bf5b5c5958ba3c89223361e892

    • SHA1

      743b4954c6f9d366ac494890e2f224c3f92e87cd

    • SHA256

      bff2d0358b6b5cce52c454ba58b74a5791ee5cb1980adc24ca1a6e540c2b85f9

    • SHA512

      2cad5e30cd676903f9a08cb40e745b75feb93c37d8b14ea945fe5d91821b59cf65c0fa87726a3b62b67aaa37dd3ca986d8517c1cd6179407491c2f54bb343cc9

    • SSDEEP

      12288:MJGT1fRo0AoELtG+BmjwHr/CQIadQXxe1iE99aWw:MJGZfRoj/Q+Bm0DCZxe1iED

    Score
    10/10
    redlinesectopratutsinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks