General

  • Target

    JaffaCakes118_4b40f735a4b37db67f7857cd0050c686

  • Size

    810KB

  • Sample

    250101-hn3sraxqbw

  • MD5

    4b40f735a4b37db67f7857cd0050c686

  • SHA1

    fe15d4be04d6d1403c4435ade671418cdebef301

  • SHA256

    f75f41f8bdbbbcbe5cdd254d3f388bc9f96afd15e2caf603fdfac0ce109e92b9

  • SHA512

    1831989c574b184a43f607c564c394e26cdba508cf83dac9ec21b9a704c6c4fdac1101075c701185bcc0accb7e9de11b25c8adc9ec017eb77b4cf8cc64c52cd4

  • SSDEEP

    12288:u+1Fjh58/2h7zHbISj8bmsRno97t+C3NSqndbSJxYakzJuhItDIVIeVwQ:u+19h55h7zHGTK9gONgJMchItDIIsj

Malware Config

Extracted

Family

redline

Botnet

@Stewor

C2

95.181.152.5:46927

Attributes
  • auth_value

    cdf3919a262c0d6ba99116b375d7551c

Targets

    • Target

      JaffaCakes118_4b40f735a4b37db67f7857cd0050c686

    • Size

      810KB

    • MD5

      4b40f735a4b37db67f7857cd0050c686

    • SHA1

      fe15d4be04d6d1403c4435ade671418cdebef301

    • SHA256

      f75f41f8bdbbbcbe5cdd254d3f388bc9f96afd15e2caf603fdfac0ce109e92b9

    • SHA512

      1831989c574b184a43f607c564c394e26cdba508cf83dac9ec21b9a704c6c4fdac1101075c701185bcc0accb7e9de11b25c8adc9ec017eb77b4cf8cc64c52cd4

    • SSDEEP

      12288:u+1Fjh58/2h7zHbISj8bmsRno97t+C3NSqndbSJxYakzJuhItDIVIeVwQ:u+19h55h7zHGTK9gONgJMchItDIIsj

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks