General

  • Target

    JaffaCakes118_3569443660530ad9921f7023d1ceb16c

  • Size

    821KB

  • Sample

    241231-zczqdsxrc1

  • MD5

    3569443660530ad9921f7023d1ceb16c

  • SHA1

    a6e8cf8e37abfda44703ac057c5ba0026d578693

  • SHA256

    1aa1d6dc9b8891b09abc24322af2d0dad6a266bcbcb1e58925932b47c4372219

  • SHA512

    b7aa4b879c0ef8668af25457e1e5a63059352e1e4e10593bc526cd06753ae14b3b99b3224c05f0ee54a7cbeaf185e32aec5c6d562e6c6eb4e3fab8b621be0035

  • SSDEEP

    12288:U5C5ndEs+qFgvaxHlS7JrVVzoxolt4RWAxoIgXXjR6XKmpPHe7IIGD38K3Rqwoci:d5nx+sgu2YxolQxEDUagPHe87R3WD

Malware Config

Extracted

Family

redline

Botnet

@kulunchick_bot

C2

95.181.152.5:46927

Attributes
  • auth_value

    cdf3919a262c0d6ba99116b375d7551c

Targets

    • Target

      JaffaCakes118_3569443660530ad9921f7023d1ceb16c

    • Size

      821KB

    • MD5

      3569443660530ad9921f7023d1ceb16c

    • SHA1

      a6e8cf8e37abfda44703ac057c5ba0026d578693

    • SHA256

      1aa1d6dc9b8891b09abc24322af2d0dad6a266bcbcb1e58925932b47c4372219

    • SHA512

      b7aa4b879c0ef8668af25457e1e5a63059352e1e4e10593bc526cd06753ae14b3b99b3224c05f0ee54a7cbeaf185e32aec5c6d562e6c6eb4e3fab8b621be0035

    • SSDEEP

      12288:U5C5ndEs+qFgvaxHlS7JrVVzoxolt4RWAxoIgXXjR6XKmpPHe7IIGD38K3Rqwoci:d5nx+sgu2YxolQxEDUagPHe87R3WD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks