redline | faf0657a5febd4dcbec532ce86d4404fd9b2970189e5f8cb6dbfcbb59833f072

Analysis

max time kernel
146s
max time network
161s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 09:50

Target

d05c1aa16e99fb31739257b6cdec229b_JaffaCakes118.exe
Size

385KB
MD5

d05c1aa16e99fb31739257b6cdec229b
SHA1

c950a6b47492d0128a197f8e72cf86e94a9b70d4
SHA256

faf0657a5febd4dcbec532ce86d4404fd9b2970189e5f8cb6dbfcbb59833f072
SHA512

e30606bd3784b480942e5561e1f0c590cddb444f4d5284408de00b23dab0e1807966b7532ef9390a0e84776fd3bca9bde075f618e5fc4d5ce2e58115a8380092
SSDEEP

6144:7gcwElSri+TxjPhNHbv+7GD5vQyZbnvCRPI9LAN89H60NB:73wEoG+9jLbvDD54UnvV9L+88E

Score

10^/10

Family

redline

Botnet

build

77.232.40.127:8204

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/928-4-0x0000000001720000-0x0000000001744000-memory.dmp	family_redline
behavioral1/memory/928-6-0x0000000005BA0000-0x0000000005BE0000-memory.dmp	family_redline
behavioral1/memory/928-8-0x00000000032E0000-0x0000000003302000-memory.dmp	family_redline
behavioral1/memory/928-9-0x0000000005BA0000-0x0000000005BE0000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/928-4-0x0000000001720000-0x0000000001744000-memory.dmp	family_sectoprat
behavioral1/memory/928-6-0x0000000005BA0000-0x0000000005BE0000-memory.dmp	family_sectoprat
behavioral1/memory/928-8-0x00000000032E0000-0x0000000003302000-memory.dmp	family_sectoprat
behavioral1/memory/928-9-0x0000000005BA0000-0x0000000005BE0000-memory.dmp	family_sectoprat

C:\Users\Admin\AppData\Local\Temp\d05c1aa16e99fb31739257b6cdec229b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d05c1aa16e99fb31739257b6cdec229b_JaffaCakes118.exe"
1⤵
PID:928

memory/928-1-0x00000000017A0000-0x00000000018A0000-memory.dmp

Filesize
1024KB

Download
memory/928-2-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/928-3-0x0000000000400000-0x00000000016D3000-memory.dmp

Filesize
18.8MB

Download
memory/928-4-0x0000000001720000-0x0000000001744000-memory.dmp

Filesize
144KB

Download
memory/928-6-0x0000000005BA0000-0x0000000005BE0000-memory.dmp

Filesize
256KB

Download
memory/928-5-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/928-7-0x0000000005BA0000-0x0000000005BE0000-memory.dmp

Filesize
256KB

Download
memory/928-8-0x00000000032E0000-0x0000000003302000-memory.dmp

Filesize
136KB

Download
memory/928-9-0x0000000005BA0000-0x0000000005BE0000-memory.dmp

Filesize
256KB

Download
memory/928-12-0x00000000017A0000-0x00000000018A0000-memory.dmp

Filesize
1024KB

Download
memory/928-13-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/928-14-0x0000000005BA0000-0x0000000005BE0000-memory.dmp

Filesize
256KB

Download