Overview

overview

10

Static

static

1

f332e7f44c...18.exe

windows7-x64

10

f332e7f44c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f332e7f44c7b84edf55f8886b3560a98_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240416-ljxbysee48

  • MD5

    f332e7f44c7b84edf55f8886b3560a98

  • SHA1

    941c3c6e7e1061732b04663ee7a54b9a7e09624e

  • SHA256

    65f91118840e33ce67f14c06b155bce15b9c26368bce65ae74b474806fbdb241

  • SHA512

    27b011999042f7f127e6c67f0aa978eabe6b33064891bbee5ae8208bd02487224730d71f9c9e34cc95927f3601256b3646c293fb7993c652b52c45896b1a8148

  • SSDEEP

    12288:z6kCCW71by5Vq3nwIEjVe9Ckdxyg+GhZRIT/nKu1IcHG9K0dcB7f6RAE5CHxrjCk:BCCW71KyIz

Score
10/10
redlinesectoprat1infostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

1

C2

tstamore.info:80

Targets

    • Target

      f332e7f44c7b84edf55f8886b3560a98_JaffaCakes118

    • Size

      1.1MB

    • MD5

      f332e7f44c7b84edf55f8886b3560a98

    • SHA1

      941c3c6e7e1061732b04663ee7a54b9a7e09624e

    • SHA256

      65f91118840e33ce67f14c06b155bce15b9c26368bce65ae74b474806fbdb241

    • SHA512

      27b011999042f7f127e6c67f0aa978eabe6b33064891bbee5ae8208bd02487224730d71f9c9e34cc95927f3601256b3646c293fb7993c652b52c45896b1a8148

    • SSDEEP

      12288:z6kCCW71by5Vq3nwIEjVe9Ckdxyg+GhZRIT/nKu1IcHG9K0dcB7f6RAE5CHxrjCk:BCCW71KyIz

    Score
    10/10
    redlinesectoprat1infostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks