General

  • Target

    44c2375f3d69ac3dedb54964ae0d8e82_JaffaCakes118

  • Size

    326KB

  • Sample

    240714-hmt48azhkl

  • MD5

    44c2375f3d69ac3dedb54964ae0d8e82

  • SHA1

    cac4b80f0a5e98ad68dd6e64217a3f8c61030dbf

  • SHA256

    62c2b9d1a5920de556f46a6e993bdbcc026ed9400c78c58061d8f31205df58d5

  • SHA512

    e2d9c3147dfc1cbc3cd69ca039e0cb6973b8ed0bcb3f2ccdf500e7c7ce9ebd33cd1922b4a343a1435124ebb235e0dcbf583cf6362b49d489f63be5c9afa75fec

  • SSDEEP

    6144:m4u8gPQpk8byOe2DXAgD6yJOLNLKTYdVSHqiEVsu:mDrAk8byOe0AgDBJOL1KTgOEVsu

Malware Config

Extracted

Family

redline

Botnet

4

C2

80.87.192.249:16640

Attributes
  • auth_value

    3e4c638c72124e45bcf5164456741cce

Targets

    • Target

      44c2375f3d69ac3dedb54964ae0d8e82_JaffaCakes118

    • Size

      326KB

    • MD5

      44c2375f3d69ac3dedb54964ae0d8e82

    • SHA1

      cac4b80f0a5e98ad68dd6e64217a3f8c61030dbf

    • SHA256

      62c2b9d1a5920de556f46a6e993bdbcc026ed9400c78c58061d8f31205df58d5

    • SHA512

      e2d9c3147dfc1cbc3cd69ca039e0cb6973b8ed0bcb3f2ccdf500e7c7ce9ebd33cd1922b4a343a1435124ebb235e0dcbf583cf6362b49d489f63be5c9afa75fec

    • SSDEEP

      6144:m4u8gPQpk8byOe2DXAgD6yJOLNLKTYdVSHqiEVsu:mDrAk8byOe0AgDBJOL1KTgOEVsu

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Matrix

Tasks