General

  • Target

    JaffaCakes118_2dcada498b2801f3e76cd75895dc7358

  • Size

    790KB

  • Sample

    241231-ws3v7ssmay

  • MD5

    2dcada498b2801f3e76cd75895dc7358

  • SHA1

    71761aeba20e7f27cb1328c01396a1ecaee4690d

  • SHA256

    ffa05e8cefa16e309df3523208e0e112d7f903646c88f9753e6096c48d365aea

  • SHA512

    55fc1fbb67e1f97c73315bf525eef260dbb5d6e89e0b78ed4e751018ae2931d3471440fbc483b59e2d15392ccd350ee19a6a68211e84b73230cc8b9997af8928

  • SSDEEP

    12288:VvA1GwKfjqoUrR0+8HmwNbfEZN38Yo9rs+97eH1buP3fIGK2pjnkbT/:VvoIfFUIW+ls2pj4/

Malware Config

Extracted

Family

redline

Botnet

@siril228

C2

176.57.71.68:37814

Attributes
  • auth_value

    6e134fbe11e1fba7052c029b94245b55

Targets

    • Target

      JaffaCakes118_2dcada498b2801f3e76cd75895dc7358

    • Size

      790KB

    • MD5

      2dcada498b2801f3e76cd75895dc7358

    • SHA1

      71761aeba20e7f27cb1328c01396a1ecaee4690d

    • SHA256

      ffa05e8cefa16e309df3523208e0e112d7f903646c88f9753e6096c48d365aea

    • SHA512

      55fc1fbb67e1f97c73315bf525eef260dbb5d6e89e0b78ed4e751018ae2931d3471440fbc483b59e2d15392ccd350ee19a6a68211e84b73230cc8b9997af8928

    • SSDEEP

      12288:VvA1GwKfjqoUrR0+8HmwNbfEZN38Yo9rs+97eH1buP3fIGK2pjnkbT/:VvoIfFUIW+ls2pj4/

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks