General

  • Target

    JaffaCakes118_20ea11f4598d4983e14b09f4a8f612a8

  • Size

    318KB

  • Sample

    241231-rhznkswnej

  • MD5

    20ea11f4598d4983e14b09f4a8f612a8

  • SHA1

    dd023746f2828500756d97d64aabab98b4d24f65

  • SHA256

    f82b943fcb4c26ae04886872a5f78a0cdc0a4ee75b301e69bedebbfb07dcd4b0

  • SHA512

    ffc9aa9c77b00b79bfc920872191e4153242f4d81158d61dd27f363a8fc2d33b3412000784ae60313ec5429a578147b97997afa503294e5a5943de68e868aac6

  • SSDEEP

    6144:Q+Oa8sIFOpY55zmO0sXoaqsJ0WuutO/Vx98aC3Of7E:Qlatah5zmOlqsJqH8n

Malware Config

Extracted

Family

redline

Botnet

44

C2

185.244.217.195:21588

Attributes
  • auth_value

    0b4dd148fec0e77245f4ce28089cdd6e

Targets

    • Target

      JaffaCakes118_20ea11f4598d4983e14b09f4a8f612a8

    • Size

      318KB

    • MD5

      20ea11f4598d4983e14b09f4a8f612a8

    • SHA1

      dd023746f2828500756d97d64aabab98b4d24f65

    • SHA256

      f82b943fcb4c26ae04886872a5f78a0cdc0a4ee75b301e69bedebbfb07dcd4b0

    • SHA512

      ffc9aa9c77b00b79bfc920872191e4153242f4d81158d61dd27f363a8fc2d33b3412000784ae60313ec5429a578147b97997afa503294e5a5943de68e868aac6

    • SSDEEP

      6144:Q+Oa8sIFOpY55zmO0sXoaqsJ0WuutO/Vx98aC3Of7E:Qlatah5zmOlqsJqH8n

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks