Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31-12-2024 12:48
General
-
Target
JaffaCakes118_1c73ff249a58e37700276acdb7a4a96f.exe
-
Size
385KB
-
MD5
1c73ff249a58e37700276acdb7a4a96f
-
SHA1
f350a97292c018a365ab9fad7cf157bd713db66c
-
SHA256
ad8daadd898e47da8966ca32d90cd6bbd910a53d89b981aa434e08448b0d9645
-
SHA512
665b37e780263808e2da017ec378355127153eda41371a55a419f1d7fdb871a1b01c20ad009e99c7dc59ecc588951ef5fab28e40fb4691705022261cfcf1889e
-
SSDEEP
12288:Z+Fadoc3d1t8Ef4wBHKUVCCzOERRq2MGPXW:MFSF58UHKf4OE2t
Malware Config
Extracted
redline
build
77.232.40.127:8204
-
auth_value
275ce2c87153d4e8e3cc276c686a93de
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Redline family
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 2 IoCs
-
Sectoprat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c73ff249a58e37700276acdb7a4a96f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c73ff249a58e37700276acdb7a4a96f.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
204KB
-
Filesize
144KB
-
Filesize
18.8MB
-
Filesize
136KB
-
Filesize
1024KB