Overview

overview

10

Static

static

3

bc2cc011dc...18.exe

windows7-x64

10

bc2cc011dc...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc2cc011dc02e4eda3df44390798d8c8_JaffaCakes118

  • Size

    312KB

  • Sample

    240404-s5ga7abe9w

  • MD5

    bc2cc011dc02e4eda3df44390798d8c8

  • SHA1

    9c58e7c4869759c83a937871155dff3f48a6bf10

  • SHA256

    f1077600dffb37018b273bbd547dc4603db51bd6e9ff2b3428d344dfe365671b

  • SHA512

    debe273e6dc235714dc66a193c5bcf3cc2f8d1fada58ce8c8f19156c9874b963b5953e2fa97c9a15524b1f8f26f922536ef482390b38f4811efbd08880df1f18

  • SSDEEP

    6144:j4u8gPQpVgbsOp2D2Agw0cS5P1PgoNIqNadKZgaoCpd2LGW+2:jDrAVgbsOpNAgDB5PlgoeuS+glsdt2

Score
10/10
redlinesectopratbuildinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

build

C2

185.244.182.136:51832

Attributes
  • auth_value

    275ce2c87153d4e8e3cc276c686a93de

Targets

    • Target

      bc2cc011dc02e4eda3df44390798d8c8_JaffaCakes118

    • Size

      312KB

    • MD5

      bc2cc011dc02e4eda3df44390798d8c8

    • SHA1

      9c58e7c4869759c83a937871155dff3f48a6bf10

    • SHA256

      f1077600dffb37018b273bbd547dc4603db51bd6e9ff2b3428d344dfe365671b

    • SHA512

      debe273e6dc235714dc66a193c5bcf3cc2f8d1fada58ce8c8f19156c9874b963b5953e2fa97c9a15524b1f8f26f922536ef482390b38f4811efbd08880df1f18

    • SSDEEP

      6144:j4u8gPQpVgbsOp2D2Agw0cS5P1PgoNIqNadKZgaoCpd2LGW+2:jDrAVgbsOpNAgDB5PlgoeuS+glsdt2

    Score
    10/10
    redlinesectopratbuildinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks