General

  • Target

    59011b30630b327f21b0c6c070e6bdc3_JaffaCakes118

  • Size

    100KB

  • Sample

    241018-xpevmsveml

  • MD5

    59011b30630b327f21b0c6c070e6bdc3

  • SHA1

    b66bb460126a2341c13b4bd8aa9c75062eddc0c2

  • SHA256

    b25de8622f43e2beb203e0e394906bd6832f95277f53c4dbd59d4afbcef7b361

  • SHA512

    3ee47b6351ead753f3edc1eadb41a6d6001c0dd0121b7d29c887b5d4139c49cdea2bacf5ad142abd63d3f893bb6c9968e1b25616f61f04fa92174ee699cfa655

  • SSDEEP

    1536:Wo6aGLKCzK2ZHMkDK2e9oZPFauhwPgbue7v5ujNyAsdgnetx5REPG6WAaoigm:WdxGCzh30uv35uxyddjNWlW

Malware Config

Extracted

Family

redline

Botnet

installs2

C2

65.21.228.92:46802

Targets

    • Target

      59011b30630b327f21b0c6c070e6bdc3_JaffaCakes118

    • Size

      100KB

    • MD5

      59011b30630b327f21b0c6c070e6bdc3

    • SHA1

      b66bb460126a2341c13b4bd8aa9c75062eddc0c2

    • SHA256

      b25de8622f43e2beb203e0e394906bd6832f95277f53c4dbd59d4afbcef7b361

    • SHA512

      3ee47b6351ead753f3edc1eadb41a6d6001c0dd0121b7d29c887b5d4139c49cdea2bacf5ad142abd63d3f893bb6c9968e1b25616f61f04fa92174ee699cfa655

    • SSDEEP

      1536:Wo6aGLKCzK2ZHMkDK2e9oZPFauhwPgbue7v5ujNyAsdgnetx5REPG6WAaoigm:WdxGCzh30uv35uxyddjNWlW

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks