Overview

overview

10

Static

static

3

ca39ec8a3d...18.exe

windows7-x64

10

ca39ec8a3d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca39ec8a3d9505d7f8f5bcf6eaf2ba9a_JaffaCakes118

  • Size

    426KB

  • Sample

    240405-ekd4fabe71

  • MD5

    ca39ec8a3d9505d7f8f5bcf6eaf2ba9a

  • SHA1

    b1a1ba74b7f9e19b701fd3d99821f0bf43d1c334

  • SHA256

    5648cc1b309ec1485e999c6c35e12071de6d142b1b0aa7c7b2b34f9a31b2531a

  • SHA512

    93baffd210a55de3b7f97b81071747cd8fae44315e263227f0ec4a06bc7bb1229e27c27270b52ae71ef610f1bf37dc2947c5ae4f9217dc6db9b6dd3dbac79d6f

  • SSDEEP

    12288:yOFtMQZvxXnjDoGjk7MfMwTLU0ErexeOjdW2wa:3FtHVdvoGjkoMFrexVp

Score
10/10
redlinesectopratpaladininfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

37.228.129.48:29795

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      ca39ec8a3d9505d7f8f5bcf6eaf2ba9a_JaffaCakes118

    • Size

      426KB

    • MD5

      ca39ec8a3d9505d7f8f5bcf6eaf2ba9a

    • SHA1

      b1a1ba74b7f9e19b701fd3d99821f0bf43d1c334

    • SHA256

      5648cc1b309ec1485e999c6c35e12071de6d142b1b0aa7c7b2b34f9a31b2531a

    • SHA512

      93baffd210a55de3b7f97b81071747cd8fae44315e263227f0ec4a06bc7bb1229e27c27270b52ae71ef610f1bf37dc2947c5ae4f9217dc6db9b6dd3dbac79d6f

    • SSDEEP

      12288:yOFtMQZvxXnjDoGjk7MfMwTLU0ErexeOjdW2wa:3FtHVdvoGjkoMFrexVp

    Score
    10/10
    redlinesectopratpaladininfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks