General

  • Target

    b1ebcd72d3bbfa1066b8ecc33ea33c13_JaffaCakes118

  • Size

    100KB

  • Sample

    241129-r3x1gs1lbv

  • MD5

    b1ebcd72d3bbfa1066b8ecc33ea33c13

  • SHA1

    e359943a6b091fb01ffcec033fdb8cf841f05b56

  • SHA256

    ddaa218a629d5d9c1cbc4158b6fba8f0e02c6bfa58afb79cb87947aef81e062d

  • SHA512

    2d1639fabafcbd06d9aedf1f972fda46d74ad96fc593b84d687f4f7ef0900cac33294e495383b9fb959deec0016622f6f7be21539924f5a163d250307c10d6b3

  • SSDEEP

    1536:fm386AEAeBxVBBUeSoy+vV99Qzm7ygbue8vuuvNyAsdXeoi1xQeTEmG6WAaoigN:fi86AdG71vtQzmvWuulyddu1svk9

Malware Config

Extracted

Family

redline

Botnet

@JuicyFruicy1

C2

185.250.206.82:21330

Targets

    • Target

      b1ebcd72d3bbfa1066b8ecc33ea33c13_JaffaCakes118

    • Size

      100KB

    • MD5

      b1ebcd72d3bbfa1066b8ecc33ea33c13

    • SHA1

      e359943a6b091fb01ffcec033fdb8cf841f05b56

    • SHA256

      ddaa218a629d5d9c1cbc4158b6fba8f0e02c6bfa58afb79cb87947aef81e062d

    • SHA512

      2d1639fabafcbd06d9aedf1f972fda46d74ad96fc593b84d687f4f7ef0900cac33294e495383b9fb959deec0016622f6f7be21539924f5a163d250307c10d6b3

    • SSDEEP

      1536:fm386AEAeBxVBBUeSoy+vV99Qzm7ygbue8vuuvNyAsdXeoi1xQeTEmG6WAaoigN:fi86AdG71vtQzmvWuulyddu1svk9

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks