Overview

overview

10

Static

static

10

a76e2cdba7...18.exe

windows7-x64

10

a76e2cdba7...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a76e2cdba762de201e0668178b03bec4_JaffaCakes118
  • Size 116KB
  • Sample240818-t8xm1stbme
  • SHA256 2fd9985380a92fa918df25189e1023c27052355dc1c7f8a2d11339be7ddfc7d3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
@s0lderredlinesectoprat

Malware Config

Extracted

Family

  • redline

Botnet

  • @S0lder

C2

  • 5.39.42.4:52028

Signatures

  • RedLine payload 1 IoCs
  • Redline family
    redline
  • SectopRAT payload 1 IoCs
  • Sectoprat family
    sectoprat

File Explorer

  • a76e2cdba762de201e0668178b03bec4_JaffaCakes118
    .exe 116KB

a76e2cdba762de201e0668178b03bec4_JaffaCakes118

  • IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
  • SHA256 2fd9985380a92fa918df25189e1023c27052355dc1c7f8a2d11339be7ddfc7d3
  • MD5 SHA1 SHA512 SSDEEP
windows:4windowsx86arch:x86

  • RedLine payload

  • SectopRAT payload

PE Signature issue

Digest
67:be:9a:e4:ba:d2:b3:2c:97:cf:c3:31:8c:eb:d3:a0:8e:35:2c:8b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Rumour,O=Sleekstone Bawleys Inc.,C=GV,1.2.840.113549.1.9.1=#0c1c6775696461626c65636f706573657474696340676d61696c2e636f6d
Chains

Aug 14, 2024

Minor OS version
0
Major OS version
4
Entry point
116178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths