General

  • Target

    aa3c5ebcb2a49c1d17e0d57b1e515d95_JaffaCakes118

  • Size

    100KB

  • Sample

    241128-ah1gfawrgz

  • MD5

    aa3c5ebcb2a49c1d17e0d57b1e515d95

  • SHA1

    9d2ec9edfebf4cbb38342b7a41904def7c53b885

  • SHA256

    dd015fe4a916f31b5b650bd6d787c594119b09ee523f046a68dbdd725ba04c5f

  • SHA512

    4c34b822062c8a3dfae00923e554e7326d7b94af3e385bc35fc2cf9c075e817fc41b7bc9d108d762d1ac7d7add396488b52d1987505a9ededfced14c0b9d1c87

  • SSDEEP

    1536:Sm386AEA+RlBR8AiKJQcobIqqdNQzR7ttgbue7vSuvNyAldW7i1xQeTEiG6WAaop:Si86AdWdMPcouQzRxC3Suly2dbsvw7

Malware Config

Extracted

Family

redline

Botnet

@Stewor

C2

77.220.214.232:13459

Targets

    • Target

      aa3c5ebcb2a49c1d17e0d57b1e515d95_JaffaCakes118

    • Size

      100KB

    • MD5

      aa3c5ebcb2a49c1d17e0d57b1e515d95

    • SHA1

      9d2ec9edfebf4cbb38342b7a41904def7c53b885

    • SHA256

      dd015fe4a916f31b5b650bd6d787c594119b09ee523f046a68dbdd725ba04c5f

    • SHA512

      4c34b822062c8a3dfae00923e554e7326d7b94af3e385bc35fc2cf9c075e817fc41b7bc9d108d762d1ac7d7add396488b52d1987505a9ededfced14c0b9d1c87

    • SSDEEP

      1536:Sm386AEA+RlBR8AiKJQcobIqqdNQzR7ttgbue7vSuvNyAldW7i1xQeTEiG6WAaop:Si86AdWdMPcouQzRxC3Suly2dbsvw7

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks