General

  • Target

    JaffaCakes118_4da0bc18929af8129fcaebece4f12ca4

  • Size

    378KB

  • Sample

    250101-j5dqmaskhj

  • MD5

    4da0bc18929af8129fcaebece4f12ca4

  • SHA1

    0564e4907b6039f24b7eb5da42bbe5db868860d4

  • SHA256

    3a9be20fb9fa3f420367fce35f801cba1cb38ee910a878036ec88d018867a1f2

  • SHA512

    934c6d02d975cb3818d3e64ac78df81021499299a9f89029db25fe944798bc9a177ad64887394412a1dbf515628f2a4ef3bf724ef91121d092931f48caf97d49

  • SSDEEP

    6144:N/sWJQ2FrTCv2aq/JJ0lF8WlIqA/lN7I8YO2NFXQqX7tNfVXVHQLIiu8cfo0/pWP:psW62Fri2aMXGF8WlIXdHaewZGEX8cAt

Malware Config

Extracted

Family

redline

Botnet

4

C2

80.87.192.249:16640

Attributes
  • auth_value

    3e4c638c72124e45bcf5164456741cce

Targets

    • Target

      JaffaCakes118_4da0bc18929af8129fcaebece4f12ca4

    • Size

      378KB

    • MD5

      4da0bc18929af8129fcaebece4f12ca4

    • SHA1

      0564e4907b6039f24b7eb5da42bbe5db868860d4

    • SHA256

      3a9be20fb9fa3f420367fce35f801cba1cb38ee910a878036ec88d018867a1f2

    • SHA512

      934c6d02d975cb3818d3e64ac78df81021499299a9f89029db25fe944798bc9a177ad64887394412a1dbf515628f2a4ef3bf724ef91121d092931f48caf97d49

    • SSDEEP

      6144:N/sWJQ2FrTCv2aq/JJ0lF8WlIqA/lN7I8YO2NFXQqX7tNfVXVHQLIiu8cfo0/pWP:psW62Fri2aMXGF8WlIXdHaewZGEX8cAt

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks