General

  • Target

    f454891540efad60adb3f87d0eecad4f_JaffaCakes118

  • Size

    314KB

  • Sample

    241215-rcpw7aykal

  • MD5

    f454891540efad60adb3f87d0eecad4f

  • SHA1

    5eafc023d1c73228d433c191993f2a8e0fa95aa4

  • SHA256

    f4a8712ff60e645d7487c4251417cd93721af78ddf64d1de82bb042a0639fa5b

  • SHA512

    8531a23c795e9b0eba47cd11fef65ec1c63e192fb0f13e1003ec3d4c90a8d2bd643488d7983fb593e817bdf1d11b94a75a2cedd5fb3906b8ba73a0abf1ccc982

  • SSDEEP

    6144:jeFwFeYdZMfsLs9+iihb128lWhvtQ+g3xB3LWwnEdpb0H5Kr0fpWph:jyG/dZMz+dlcvtQ+g3xVWXB45k0pWp

Malware Config

Extracted

Family

redline

Botnet

seodom

C2

senaildebe.xyz:80

adoniexmar.xyz:80

Targets

    • Target

      f454891540efad60adb3f87d0eecad4f_JaffaCakes118

    • Size

      314KB

    • MD5

      f454891540efad60adb3f87d0eecad4f

    • SHA1

      5eafc023d1c73228d433c191993f2a8e0fa95aa4

    • SHA256

      f4a8712ff60e645d7487c4251417cd93721af78ddf64d1de82bb042a0639fa5b

    • SHA512

      8531a23c795e9b0eba47cd11fef65ec1c63e192fb0f13e1003ec3d4c90a8d2bd643488d7983fb593e817bdf1d11b94a75a2cedd5fb3906b8ba73a0abf1ccc982

    • SSDEEP

      6144:jeFwFeYdZMfsLs9+iihb128lWhvtQ+g3xB3LWwnEdpb0H5Kr0fpWph:jyG/dZMz+dlcvtQ+g3xVWXB45k0pWp

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks