Overview

overview

10

Static

static

3

fcd6f9dc4c...18.exe

windows7-x64

10

fcd6f9dc4c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fcd6f9dc4c2dedb09f02e98ae484275c_JaffaCakes118

  • Size

    2.3MB

  • Sample

    240420-qgclzshe39

  • MD5

    fcd6f9dc4c2dedb09f02e98ae484275c

  • SHA1

    3caa9da0bdd2d95f9e4f2293e16fb3f0609c0aa1

  • SHA256

    2b8dd6e401df9a624a3255fce908ac384eb3013d69651c0d133521e2409cbdf9

  • SHA512

    e790c7d0af673e4c6c414b27af5fdd894708f31c03943ff2f5d2f28c2c0f261e62c86fd177228c524eae28d450c8934f3b0ca2f117aad2b87c7c21e935b2ece5

  • SSDEEP

    49152:25+hF6ujRlg2cvPauujSAzH9GsnfBgh2Px5ej75/xiz8lVHTIioOFZQ+R:25aF6ujRmFDAz9fBx5ev5/xiqZ7R

Score
10/10
redlinesectoprat@ditrcinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

@DitrC

C2

45.132.104.217:12780

Attributes
  • auth_value

    bb67ccc49d44343128ca161d7fe51029

Targets

    • Target

      fcd6f9dc4c2dedb09f02e98ae484275c_JaffaCakes118

    • Size

      2.3MB

    • MD5

      fcd6f9dc4c2dedb09f02e98ae484275c

    • SHA1

      3caa9da0bdd2d95f9e4f2293e16fb3f0609c0aa1

    • SHA256

      2b8dd6e401df9a624a3255fce908ac384eb3013d69651c0d133521e2409cbdf9

    • SHA512

      e790c7d0af673e4c6c414b27af5fdd894708f31c03943ff2f5d2f28c2c0f261e62c86fd177228c524eae28d450c8934f3b0ca2f117aad2b87c7c21e935b2ece5

    • SSDEEP

      49152:25+hF6ujRlg2cvPauujSAzH9GsnfBgh2Px5ej75/xiz8lVHTIioOFZQ+R:25aF6ujRmFDAz9fBx5ev5/xiqZ7R

    Score
    10/10
    redlinesectoprat@ditrcinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks