Overview

overview

10

Static

static

3

ee558358e0...18.exe

windows7-x64

10

ee558358e0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ee558358e0210fac68e8e64d32adca4e_JaffaCakes118

  • Size

    623KB

  • Sample

    240411-zvf11agc8z

  • MD5

    ee558358e0210fac68e8e64d32adca4e

  • SHA1

    7e1cc4531f6ff07476c2f1eddc3d5ab02e9e5590

  • SHA256

    e31887ee65c8d2262c10925f2dc3a95da667d913e32eafa7011649a625840182

  • SHA512

    ddeec6c5fafa209da9ac0ce538b10e86585dea1246f4e7cb837021627d5846bb4a802215b2e21c285a253d857dbfe2dbe6ba581d08a7f59f4352394f58cd7379

  • SSDEEP

    12288:h6EXhzC7b94xVLct417DY9ACfjkeEa0GpHhxTHUZWXCowJ+:h6oo4D7D

Score
10/10
redlinesectoprattestinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

test

C2

45.14.49.169:22411

Targets

    • Target

      ee558358e0210fac68e8e64d32adca4e_JaffaCakes118

    • Size

      623KB

    • MD5

      ee558358e0210fac68e8e64d32adca4e

    • SHA1

      7e1cc4531f6ff07476c2f1eddc3d5ab02e9e5590

    • SHA256

      e31887ee65c8d2262c10925f2dc3a95da667d913e32eafa7011649a625840182

    • SHA512

      ddeec6c5fafa209da9ac0ce538b10e86585dea1246f4e7cb837021627d5846bb4a802215b2e21c285a253d857dbfe2dbe6ba581d08a7f59f4352394f58cd7379

    • SSDEEP

      12288:h6EXhzC7b94xVLct417DY9ACfjkeEa0GpHhxTHUZWXCowJ+:h6oo4D7D

    Score
    10/10
    redlinesectoprattestinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks