Overview

overview

10

Static

static

3

d4d372c1d8...18.exe

windows7-x64

10

d4d372c1d8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d4d372c1d84a82237676f61c56ae7f9c_JaffaCakes118

  • Size

    317KB

  • Sample

    240405-qlft7sdb4z

  • MD5

    d4d372c1d84a82237676f61c56ae7f9c

  • SHA1

    6e38abf69881e1e8c6cad5ac8e519700727675f7

  • SHA256

    fc503192818617738ef71f55ba64ada4f60353b12dfdaedb481534e7d43b314f

  • SHA512

    3534a82e288f54e4fa4a633a1d4deb95796795cde10ca1a2333d51db1f1562897128d1b74b5f2057133fad8acc8f4eaf7c2ea5bb8c499b3e5802cd4d1e74ac61

  • SSDEEP

    6144:6uehM8Ib+fmGu0QYMj+/y5LY4FCr1CBx31W5JfI/Vx98aC36nnmC+Eh:6lhtnHeC/s84AKjW2H8n6nmy

Score
10/10
redlinesectopratusamoneyinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

usamoney

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      d4d372c1d84a82237676f61c56ae7f9c_JaffaCakes118

    • Size

      317KB

    • MD5

      d4d372c1d84a82237676f61c56ae7f9c

    • SHA1

      6e38abf69881e1e8c6cad5ac8e519700727675f7

    • SHA256

      fc503192818617738ef71f55ba64ada4f60353b12dfdaedb481534e7d43b314f

    • SHA512

      3534a82e288f54e4fa4a633a1d4deb95796795cde10ca1a2333d51db1f1562897128d1b74b5f2057133fad8acc8f4eaf7c2ea5bb8c499b3e5802cd4d1e74ac61

    • SSDEEP

      6144:6uehM8Ib+fmGu0QYMj+/y5LY4FCr1CBx31W5JfI/Vx98aC36nnmC+Eh:6lhtnHeC/s84AKjW2H8n6nmy

    Score
    10/10
    redlinesectopratusamoneyinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks