General

  • Target

    d26ecad2f1da070dbdde7a3a36109175_JaffaCakes118

  • Size

    262KB

  • Sample

    241207-plkygsskfv

  • MD5

    d26ecad2f1da070dbdde7a3a36109175

  • SHA1

    b58f8439f7f602355b284518463dfa49633c4c90

  • SHA256

    aa3ef811cfeacbe782715219b91eb5f798780b6e81a3dd31eb4c2a8851689b54

  • SHA512

    14afc0922789281fce926e69ee54f7f72260d47f92600c2ba41f15fb6ad793e4763e71acd5966d9dc37e8524c74b6df0c947e1633a092c66dad0d5f912c30816

  • SSDEEP

    1536:Bm386AEA+T2BX8bPm5AvkAK6yBGQzi7bgbue7vVuvNy6sddNi1xQeTEmG6WAaoif:Bi86AdwuTAxQzi43VulyLdesvkJwj

Malware Config

Extracted

Family

redline

Botnet

FBtraff

C2

185.237.165.126:25598

Targets

    • Target

      d26ecad2f1da070dbdde7a3a36109175_JaffaCakes118

    • Size

      262KB

    • MD5

      d26ecad2f1da070dbdde7a3a36109175

    • SHA1

      b58f8439f7f602355b284518463dfa49633c4c90

    • SHA256

      aa3ef811cfeacbe782715219b91eb5f798780b6e81a3dd31eb4c2a8851689b54

    • SHA512

      14afc0922789281fce926e69ee54f7f72260d47f92600c2ba41f15fb6ad793e4763e71acd5966d9dc37e8524c74b6df0c947e1633a092c66dad0d5f912c30816

    • SSDEEP

      1536:Bm386AEA+T2BX8bPm5AvkAK6yBGQzi7bgbue7vVuvNy6sddNi1xQeTEmG6WAaoif:Bi86AdwuTAxQzi43VulyLdesvkJwj

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks