Overview

overview

10

Static

static

3

e5b21a3a78...18.exe

windows7-x64

10

e5b21a3a78...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e5b21a3a7853fd12c8fa65bb1abec7f9_JaffaCakes118

  • Size

    314KB

  • Sample

    240407-yaastacg83

  • MD5

    e5b21a3a7853fd12c8fa65bb1abec7f9

  • SHA1

    083d0f8125eefa13cf340ebe3a4ff31c5c30f7fe

  • SHA256

    eb79c07d2967248ea62bfcf9698c175b3208ee2a8b69beef9a9ed0994315c91a

  • SHA512

    0be09389b49e4cdaa7a57bbbce863f8eb6b7898958999bdb6b97a001ac6fd608eaa890c95f9bbf3394b318a2ccdbda9571e6f479fb25bebc208b293fa8f6adb0

  • SSDEEP

    6144:bVk3OQ3owYCvgC/VeFnlL/ZXWxZhAkH7knGyHM:bVOOD7azGnlL/ZXWpZHI

Score
10/10
redlinesectopratsewpalpadininfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

C2

185.215.113.114:8887

Targets

    • Target

      e5b21a3a7853fd12c8fa65bb1abec7f9_JaffaCakes118

    • Size

      314KB

    • MD5

      e5b21a3a7853fd12c8fa65bb1abec7f9

    • SHA1

      083d0f8125eefa13cf340ebe3a4ff31c5c30f7fe

    • SHA256

      eb79c07d2967248ea62bfcf9698c175b3208ee2a8b69beef9a9ed0994315c91a

    • SHA512

      0be09389b49e4cdaa7a57bbbce863f8eb6b7898958999bdb6b97a001ac6fd608eaa890c95f9bbf3394b318a2ccdbda9571e6f479fb25bebc208b293fa8f6adb0

    • SSDEEP

      6144:bVk3OQ3owYCvgC/VeFnlL/ZXWxZhAkH7knGyHM:bVOOD7azGnlL/ZXWpZHI

    Score
    10/10
    redlinesectopratsewpalpadininfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks