General

  • Target

    JaffaCakes118_4bde2ac5042df0b4b6e1482a83ca7a13

  • Size

    318KB

  • Sample

    250101-h2yqysyjgz

  • MD5

    4bde2ac5042df0b4b6e1482a83ca7a13

  • SHA1

    2a156cef297c2e08da5e56e8813194cf8d77edfc

  • SHA256

    1ad569cc938b75d3b2a4a7afc4c7f9da55e4e0ef7054bc30957d0346d8ae8422

  • SHA512

    5e1d3fd85b52fd2bf2550c1ebd766931e208a5f112144b3d84a66d4683aef46ce26667afbbd48b510d07415d68fe48cae6241ccef4f200fb37c7ad476f20c3fe

  • SSDEEP

    6144:AuehM8I5J2+C4R9d+r2gluhGpahAnzF0m/Vx98aC3NS5eE:Alhtm2+Xj+OhGghAVH8nA5

Malware Config

Extracted

Family

redline

Botnet

build3

C2

77.232.40.127:8204

Attributes
  • auth_value

    275ce2c87153d4e8e3cc276c686a93de

Targets

    • Target

      JaffaCakes118_4bde2ac5042df0b4b6e1482a83ca7a13

    • Size

      318KB

    • MD5

      4bde2ac5042df0b4b6e1482a83ca7a13

    • SHA1

      2a156cef297c2e08da5e56e8813194cf8d77edfc

    • SHA256

      1ad569cc938b75d3b2a4a7afc4c7f9da55e4e0ef7054bc30957d0346d8ae8422

    • SHA512

      5e1d3fd85b52fd2bf2550c1ebd766931e208a5f112144b3d84a66d4683aef46ce26667afbbd48b510d07415d68fe48cae6241ccef4f200fb37c7ad476f20c3fe

    • SSDEEP

      6144:AuehM8I5J2+C4R9d+r2gluhGpahAnzF0m/Vx98aC3NS5eE:Alhtm2+Xj+OhGghAVH8nA5

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks