General

  • Target

    ad68b61705f977cfc385cfacaee592c1_JaffaCakes118

  • Size

    327KB

  • Sample

    241128-yldnvayjhx

  • MD5

    ad68b61705f977cfc385cfacaee592c1

  • SHA1

    d696b36aba2fc60a456b4dd4408d89e8bc913e89

  • SHA256

    987804b7b78a6da6a95a561b58ff27e53c0dffe16dc9a305754cff3c1387847d

  • SHA512

    0d076b03039c222ab488a1dec96feb5e210b67e883d2022ac5161d823c80732b3f678fbf93b22e8278c550c91522a03f8a08586e23f8226a7562eee764dc64e7

  • SSDEEP

    6144:1MfcF3QG5FEIbwUYECfkF/49q7Gcbrg+FUplTlbehHsu:16igG5FBwU3fFBbrJmTysu

Malware Config

Extracted

Family

redline

Botnet

2

C2

80.87.192.249:16640

Targets

    • Target

      ad68b61705f977cfc385cfacaee592c1_JaffaCakes118

    • Size

      327KB

    • MD5

      ad68b61705f977cfc385cfacaee592c1

    • SHA1

      d696b36aba2fc60a456b4dd4408d89e8bc913e89

    • SHA256

      987804b7b78a6da6a95a561b58ff27e53c0dffe16dc9a305754cff3c1387847d

    • SHA512

      0d076b03039c222ab488a1dec96feb5e210b67e883d2022ac5161d823c80732b3f678fbf93b22e8278c550c91522a03f8a08586e23f8226a7562eee764dc64e7

    • SSDEEP

      6144:1MfcF3QG5FEIbwUYECfkF/49q7Gcbrg+FUplTlbehHsu:16igG5FBwU3fFBbrJmTysu

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks