General

  • Target

    f07974ed04e44531df1d7bef26664ed2_JaffaCakes118

  • Size

    316KB

  • Sample

    241214-yvg3maspbs

  • MD5

    f07974ed04e44531df1d7bef26664ed2

  • SHA1

    4c823464b56c38be00edd84eae3eebf9f3163ea8

  • SHA256

    3fa6990a53a8ddf703a4ae9dd505deba4689fbdae228bf19a0a386ac9f934da4

  • SHA512

    0f6ac74e3e3d06044e4e72b4ead8189842717844eb27691f75243d3aeb956e4062e195d6fd3d463e9b3fb11d1044b3b7392a0cfdeb9b13c80e8ea98a8b2568be

  • SSDEEP

    6144:NrGvPD3Ptrbd/y4J7nV0uKG9R7KwoR11ha+21eml7CsgcF:NrGvPD3Fp/F79XewoR1PaTYsZ

Malware Config

Extracted

Family

redline

Botnet

Star2kk

C2

185.173.37.47:13475

Targets

    • Target

      f07974ed04e44531df1d7bef26664ed2_JaffaCakes118

    • Size

      316KB

    • MD5

      f07974ed04e44531df1d7bef26664ed2

    • SHA1

      4c823464b56c38be00edd84eae3eebf9f3163ea8

    • SHA256

      3fa6990a53a8ddf703a4ae9dd505deba4689fbdae228bf19a0a386ac9f934da4

    • SHA512

      0f6ac74e3e3d06044e4e72b4ead8189842717844eb27691f75243d3aeb956e4062e195d6fd3d463e9b3fb11d1044b3b7392a0cfdeb9b13c80e8ea98a8b2568be

    • SSDEEP

      6144:NrGvPD3Ptrbd/y4J7nV0uKG9R7KwoR11ha+21eml7CsgcF:NrGvPD3Fp/F79XewoR1PaTYsZ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks