General

  • Target

    f78f2e70b20587810b755e56821a0363_JaffaCakes118

  • Size

    100KB

  • Sample

    241216-gb719sxrhn

  • MD5

    f78f2e70b20587810b755e56821a0363

  • SHA1

    0fb165666b097266421b16bd715926d979e55c23

  • SHA256

    93294f23cc879d497276dfcb0def6cbb8d33617648f75358f213886f6e5682b4

  • SHA512

    6f9327f0026b254d035adefd486c9dabda7aeadda6372c52e405abc8ffad9ce904de6bdd0006eebdbaa65673032b42ff58a042ee611be8aec501c826762a2a0a

  • SSDEEP

    1536:vo6aGbaCsimsMHOY/NohLIGOFauaqwggbue7vyucNyAsdJoetx5REzG6WAaoig7:vdxmCgBJGOcDqC3yuKyddPNWZr

Malware Config

Extracted

Family

redline

Botnet

@twixrf

C2

185.224.132.232:64354

Targets

    • Target

      f78f2e70b20587810b755e56821a0363_JaffaCakes118

    • Size

      100KB

    • MD5

      f78f2e70b20587810b755e56821a0363

    • SHA1

      0fb165666b097266421b16bd715926d979e55c23

    • SHA256

      93294f23cc879d497276dfcb0def6cbb8d33617648f75358f213886f6e5682b4

    • SHA512

      6f9327f0026b254d035adefd486c9dabda7aeadda6372c52e405abc8ffad9ce904de6bdd0006eebdbaa65673032b42ff58a042ee611be8aec501c826762a2a0a

    • SSDEEP

      1536:vo6aGbaCsimsMHOY/NohLIGOFauaqwggbue7vyucNyAsdJoetx5REzG6WAaoig7:vdxmCgBJGOcDqC3yuKyddPNWZr

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks