General

  • Target

    a0dfd4af2c176679731bb4ac406333be_JaffaCakes118

  • Size

    382KB

  • Sample

    241126-kfbemszker

  • MD5

    a0dfd4af2c176679731bb4ac406333be

  • SHA1

    e02fb152043ab42f47570659666427fc40836bba

  • SHA256

    1ee024f712833ad9885e44c3e9a8b14a22de1769adb94a0aab6577c36c4d10c2

  • SHA512

    b0ca6cddd589b692e7b87f65a601e7789803d9d1c2f51b2015db394fd6e50a11b69c0e5056046b53ee06bba5e6cd7d0ced4ae3ad14fba2079aeba37404d59c6a

  • SSDEEP

    6144:SvjBNOg+Hb5LfqjHv0FFe0LimOrZNCNUR+0S99i1KJowH2VrStvSaLsxrVpMc:mBYJ75LCjHvAhLimOSNl9i1coqKWhSe6

Malware Config

Extracted

Family

redline

Botnet

TEST

C2

193.56.146.78:54955

Targets

    • Target

      a0dfd4af2c176679731bb4ac406333be_JaffaCakes118

    • Size

      382KB

    • MD5

      a0dfd4af2c176679731bb4ac406333be

    • SHA1

      e02fb152043ab42f47570659666427fc40836bba

    • SHA256

      1ee024f712833ad9885e44c3e9a8b14a22de1769adb94a0aab6577c36c4d10c2

    • SHA512

      b0ca6cddd589b692e7b87f65a601e7789803d9d1c2f51b2015db394fd6e50a11b69c0e5056046b53ee06bba5e6cd7d0ced4ae3ad14fba2079aeba37404d59c6a

    • SSDEEP

      6144:SvjBNOg+Hb5LfqjHv0FFe0LimOrZNCNUR+0S99i1KJowH2VrStvSaLsxrVpMc:mBYJ75LCjHvAhLimOSNl9i1coqKWhSe6

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks