General

  • Target

    bbb82a257aeaf8f90c9e6fd293e57955_JaffaCakes118

  • Size

    329KB

  • Sample

    241203-e5ntdawldp

  • MD5

    bbb82a257aeaf8f90c9e6fd293e57955

  • SHA1

    590d09afe1e631bbc402fbf540c739c960e9f92b

  • SHA256

    ebc80e1346cff14860018e9e4fb0e3acc1ba78f8530079aa31310d4e81e477fc

  • SHA512

    e9bd48e8d4e02b76b3cc351a7a22e6ec06224155d41c663f0e2cfbf428217ce3dba60e4a721b193f54cb2b87bbe42bc151ca7255e7359ee52074edadcf4d2e89

  • SSDEEP

    6144:YsS8ZnXttgL6hwSfJLQPMU+wo53a3tuiNckVl3SnWEgDsu:YsS8ZnzgLmfJLSRvoB+turkbSWLsu

Malware Config

Extracted

Family

redline

Botnet

2

C2

80.87.192.249:16640

Targets

    • Target

      bbb82a257aeaf8f90c9e6fd293e57955_JaffaCakes118

    • Size

      329KB

    • MD5

      bbb82a257aeaf8f90c9e6fd293e57955

    • SHA1

      590d09afe1e631bbc402fbf540c739c960e9f92b

    • SHA256

      ebc80e1346cff14860018e9e4fb0e3acc1ba78f8530079aa31310d4e81e477fc

    • SHA512

      e9bd48e8d4e02b76b3cc351a7a22e6ec06224155d41c663f0e2cfbf428217ce3dba60e4a721b193f54cb2b87bbe42bc151ca7255e7359ee52074edadcf4d2e89

    • SSDEEP

      6144:YsS8ZnXttgL6hwSfJLQPMU+wo53a3tuiNckVl3SnWEgDsu:YsS8ZnzgLmfJLSRvoB+turkbSWLsu

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks