General

  • Target

    3edc5f61b275527d3685436e58c0084a_JaffaCakes118

  • Size

    100KB

  • Sample

    241013-kkqecssarr

  • MD5

    3edc5f61b275527d3685436e58c0084a

  • SHA1

    420392b46764ec08c03a2aed4e8f33b66e39d57a

  • SHA256

    b41aea701c6900ee8a280812caa8c7ae07c54aafa358a02e7b63bf46c6e336e7

  • SHA512

    fc7dfd1e73bf11dd638dd31e42b070511a2fcf90b4c52775182d51b120bfe9a53c83e0db286da7737d7ce397df387b322f48028c872aedf21d540e72d7ebe782

  • SSDEEP

    1536:5m386AEAOXyBr84a+NZP/d06gBGQzJ7S7kgbue7vauvNyAsdnTi1xQeTEiG6WAau:5i86Ads2FNZwGQzJeF3aulyddGsvw9

Malware Config

Extracted

Family

redline

Botnet

@gido_bets2

C2

18.117.82.8:58546

Targets

    • Target

      3edc5f61b275527d3685436e58c0084a_JaffaCakes118

    • Size

      100KB

    • MD5

      3edc5f61b275527d3685436e58c0084a

    • SHA1

      420392b46764ec08c03a2aed4e8f33b66e39d57a

    • SHA256

      b41aea701c6900ee8a280812caa8c7ae07c54aafa358a02e7b63bf46c6e336e7

    • SHA512

      fc7dfd1e73bf11dd638dd31e42b070511a2fcf90b4c52775182d51b120bfe9a53c83e0db286da7737d7ce397df387b322f48028c872aedf21d540e72d7ebe782

    • SSDEEP

      1536:5m386AEAOXyBr84a+NZP/d06gBGQzJ7S7kgbue7vauvNyAsdnTi1xQeTEiG6WAau:5i86Ads2FNZwGQzJeF3aulyddGsvw9

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks