General

  • Target

    f22d004ce542e5a09b7259b4601e1df6_JaffaCakes118

  • Size

    314KB

  • Sample

    241215-ejqqvatkbz

  • MD5

    f22d004ce542e5a09b7259b4601e1df6

  • SHA1

    1b6d0e5bfa3394b7692b821f61d81ce3fdeb5296

  • SHA256

    2a39b596a81b53b07ce7e195e8d493103a6c458def7876b36dc6051685f893fc

  • SHA512

    2259b9753e898d67579bdf0d3618243bb927f760872299e723512a27a002e2d32230aeba759d087828b05a2bad46e81f154474fc1105cc4f003f5cf4cc46e660

  • SSDEEP

    6144:bMGbF3Quqr4Ihxhhn7vKLeDE8N9R2vK33hfGHpKcjO:bjRguqr7xhlKLeDtzR2v83huHU

Malware Config

Extracted

Family

redline

Botnet

build1

C2

77.232.36.199:32336

Targets

    • Target

      f22d004ce542e5a09b7259b4601e1df6_JaffaCakes118

    • Size

      314KB

    • MD5

      f22d004ce542e5a09b7259b4601e1df6

    • SHA1

      1b6d0e5bfa3394b7692b821f61d81ce3fdeb5296

    • SHA256

      2a39b596a81b53b07ce7e195e8d493103a6c458def7876b36dc6051685f893fc

    • SHA512

      2259b9753e898d67579bdf0d3618243bb927f760872299e723512a27a002e2d32230aeba759d087828b05a2bad46e81f154474fc1105cc4f003f5cf4cc46e660

    • SSDEEP

      6144:bMGbF3Quqr4Ihxhhn7vKLeDE8N9R2vK33hfGHpKcjO:bjRguqr7xhlKLeDtzR2v83huHU

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks