Overview

overview

10

Static

static

3

bddf7c04e3...18.exe

windows7-x64

10

bddf7c04e3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bddf7c04e395c2b8667f553708e63d4b_JaffaCakes118

  • Size

    384KB

  • Sample

    240404-vly31adh22

  • MD5

    bddf7c04e395c2b8667f553708e63d4b

  • SHA1

    a734ccc7e163646485304a691bcff6f507c8bcc8

  • SHA256

    6c995db087c47293facd316b3aae0348829bac5282ecd7f08d3b59dfb1701ef8

  • SHA512

    c27cf2343591f2ccf55a33af22bde4db8c43859397b5bc798aa99777eae38b94ddbf56eff978824b8507f898eee1d8c729b321cad96b2535ae7d340551ff68d8

  • SSDEEP

    6144:CFjCCep3Z1pWPlb1DC1hqAVGcuDvn3CnvJbCyAOYtoL+I0+Xayn:CFjYp3ZrWPu1cANuDvSnvJpfYtI+Ne3

Score
10/10
redlinesectopratusamoneyinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

usamoney

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      bddf7c04e395c2b8667f553708e63d4b_JaffaCakes118

    • Size

      384KB

    • MD5

      bddf7c04e395c2b8667f553708e63d4b

    • SHA1

      a734ccc7e163646485304a691bcff6f507c8bcc8

    • SHA256

      6c995db087c47293facd316b3aae0348829bac5282ecd7f08d3b59dfb1701ef8

    • SHA512

      c27cf2343591f2ccf55a33af22bde4db8c43859397b5bc798aa99777eae38b94ddbf56eff978824b8507f898eee1d8c729b321cad96b2535ae7d340551ff68d8

    • SSDEEP

      6144:CFjCCep3Z1pWPlb1DC1hqAVGcuDvn3CnvJbCyAOYtoL+I0+Xayn:CFjYp3ZrWPu1cANuDvSnvJpfYtI+Ne3

    Score
    10/10
    redlinesectopratusamoneyinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks