General

  • Target

    4ff5c1332c29c3c55f0905d410b4985b_JaffaCakes118

  • Size

    100KB

  • Sample

    241017-a6ke5asgkf

  • MD5

    4ff5c1332c29c3c55f0905d410b4985b

  • SHA1

    c45eb28e4d9dcbd76ca8307b44b1e8a798ba7eb5

  • SHA256

    e8dcb5c7a02f355f0db2e0a67092cf4dd1f1b410585bd949ee18a67a850c033b

  • SHA512

    8084df33051a142c7d03ce9d206f8d6e2fac146343194ae6fad988d2f8d6d21a2c0fdfa134b39cbe626d6b5b10c6ca90e0fdf18201f5bf6eb2fca08ad7487685

  • SSDEEP

    1536:Km386AEAeBxdBBMWoKbz/LpmrK20SGDUQzau7lgbue7vRuvNyAsdHqi1xQeTE6Gd:Ki86AdGzhnLdUQzFG3RulyddTsvos

Malware Config

Extracted

Family

redline

Botnet

@Fuckersfive

C2

77.220.214.232:13459

Targets

    • Target

      4ff5c1332c29c3c55f0905d410b4985b_JaffaCakes118

    • Size

      100KB

    • MD5

      4ff5c1332c29c3c55f0905d410b4985b

    • SHA1

      c45eb28e4d9dcbd76ca8307b44b1e8a798ba7eb5

    • SHA256

      e8dcb5c7a02f355f0db2e0a67092cf4dd1f1b410585bd949ee18a67a850c033b

    • SHA512

      8084df33051a142c7d03ce9d206f8d6e2fac146343194ae6fad988d2f8d6d21a2c0fdfa134b39cbe626d6b5b10c6ca90e0fdf18201f5bf6eb2fca08ad7487685

    • SSDEEP

      1536:Km386AEAeBxdBBMWoKbz/LpmrK20SGDUQzau7lgbue7vRuvNyAsdHqi1xQeTE6Gd:Ki86AdGzhnLdUQzFG3RulyddTsvos

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks