Overview

overview

10

Static

static

3

d56da61263...18.exe

windows7-x64

10

d56da61263...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d56da61263081d38e08747912e88bce6_JaffaCakes118

  • Size

    370KB

  • Sample

    240405-q4gjfseb69

  • MD5

    d56da61263081d38e08747912e88bce6

  • SHA1

    9b4b58c955dcc8f20add44b66f7349ded5b64d5c

  • SHA256

    b811d4846756f182709e84203a4c2b146877251ca4b13e7a0e08fefa73dcabfa

  • SHA512

    97d0ae03fa7d881b78ed59673d53359138d3b3245fe32dd9048c3f6c6cff6bf7b2812a0a397b8b7167ebfae714bc80e517ae435d7ec46c1cbb58120ca61ef288

  • SSDEEP

    6144:qhIThNgnnTAReO9KcYZPyXYNU4ih/CdcPm66dJo8j9vsv+i:jNanT10XY64ih/CdX66dJouO+i

Score
10/10
redlinesectopratpubinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      d56da61263081d38e08747912e88bce6_JaffaCakes118

    • Size

      370KB

    • MD5

      d56da61263081d38e08747912e88bce6

    • SHA1

      9b4b58c955dcc8f20add44b66f7349ded5b64d5c

    • SHA256

      b811d4846756f182709e84203a4c2b146877251ca4b13e7a0e08fefa73dcabfa

    • SHA512

      97d0ae03fa7d881b78ed59673d53359138d3b3245fe32dd9048c3f6c6cff6bf7b2812a0a397b8b7167ebfae714bc80e517ae435d7ec46c1cbb58120ca61ef288

    • SSDEEP

      6144:qhIThNgnnTAReO9KcYZPyXYNU4ih/CdcPm66dJo8j9vsv+i:jNanT10XY64ih/CdX66dJouO+i

    Score
    10/10
    redlinesectopratpubinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks