Overview

overview

10

Static

static

3

fa51a99f02...18.exe

windows7-x64

10

fa51a99f02...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa51a99f025a419f8f7ac563d19a3ee5_JaffaCakes118

  • Size

    641KB

  • Sample

    240419-px9e8adg4t

  • MD5

    fa51a99f025a419f8f7ac563d19a3ee5

  • SHA1

    3ac5026b2369e3121f06f4ef8604c7f080b51d44

  • SHA256

    e60e84966abe28d739cd501c03fd7140e85c7f8cafccc4887c275c0f25e4e691

  • SHA512

    bd20acec1620d2a71a3b2215f903b5a8e45ddaf09f3eb42be173f94030c1a7638e065132a76728306c05d799008a78b4ec6f94b27b924ea164e43bdbdef97fd8

  • SSDEEP

    12288:P3SGl0gnZ5eA1Go0/6K6Qjano8ZbWs0r71VqbO/9PfH0mXo:/kM513yKmY

Score
10/10
redlinesectopratzainfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

ZA

C2

usersoft-usa.info:80

Targets

    • Target

      fa51a99f025a419f8f7ac563d19a3ee5_JaffaCakes118

    • Size

      641KB

    • MD5

      fa51a99f025a419f8f7ac563d19a3ee5

    • SHA1

      3ac5026b2369e3121f06f4ef8604c7f080b51d44

    • SHA256

      e60e84966abe28d739cd501c03fd7140e85c7f8cafccc4887c275c0f25e4e691

    • SHA512

      bd20acec1620d2a71a3b2215f903b5a8e45ddaf09f3eb42be173f94030c1a7638e065132a76728306c05d799008a78b4ec6f94b27b924ea164e43bdbdef97fd8

    • SSDEEP

      12288:P3SGl0gnZ5eA1Go0/6K6Qjano8ZbWs0r71VqbO/9PfH0mXo:/kM513yKmY

    Score
    10/10
    redlinesectopratzainfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks