Overview

overview

10

Static

static

3

eacbc2ec61...18.exe

windows7-x64

10

eacbc2ec61...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eacbc2ec617bb16c35853e5489b70de1_JaffaCakes118

  • Size

    308KB

  • Sample

    240410-lv8jcsbc99

  • MD5

    eacbc2ec617bb16c35853e5489b70de1

  • SHA1

    098f777c89369102bb6274c27b867829554ae88d

  • SHA256

    c047dcaae5a06efbe40a6bbb4b05f042fb099535598cc0ee2f66c13f65b1c839

  • SHA512

    006dc024a6a18027324443cf3fa154a675fc4350899cf3c45f705961f6017767d6562bd266da2fa491c7539609bb5d0b3836352e4ba2d9791b32c5e3fc8590d9

  • SSDEEP

    6144:H/fzUm1pTQCBpLVecdIlBRTtaMtFGdhYdgM1pyGmDW5S5:fLUmLsCBp55GlBVt3FGQ/MZW5S5

Score
10/10
redlinesectopratusamoneyinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

usamoney

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      eacbc2ec617bb16c35853e5489b70de1_JaffaCakes118

    • Size

      308KB

    • MD5

      eacbc2ec617bb16c35853e5489b70de1

    • SHA1

      098f777c89369102bb6274c27b867829554ae88d

    • SHA256

      c047dcaae5a06efbe40a6bbb4b05f042fb099535598cc0ee2f66c13f65b1c839

    • SHA512

      006dc024a6a18027324443cf3fa154a675fc4350899cf3c45f705961f6017767d6562bd266da2fa491c7539609bb5d0b3836352e4ba2d9791b32c5e3fc8590d9

    • SSDEEP

      6144:H/fzUm1pTQCBpLVecdIlBRTtaMtFGdhYdgM1pyGmDW5S5:fLUmLsCBp55GlBVt3FGQ/MZW5S5

    Score
    10/10
    redlinesectopratusamoneyinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks