General

  • Target

    JaffaCakes118_761c269ea1ce6959ec6819fda2e5b08a

  • Size

    809KB

  • Sample

    250103-3yzjaszpbv

  • MD5

    761c269ea1ce6959ec6819fda2e5b08a

  • SHA1

    1ab756adb35f3e9d7d2e6c776d2c4340340980d2

  • SHA256

    c176f607e4fa74adf107a43c13ebff55ed05482fee9c94353f1dff79924368af

  • SHA512

    097cc36146b7f58c45d107e28482e53db71c1636a2cd980b04090591440b60a0ddb19e22f2dda9a50ed40228e4bc9597d770f8ad3f7d2eb04712f6f9ad1c9ff9

  • SSDEEP

    12288:r5wbnUT3HRkUmGjEd1PxDdxKjJcm52Qr1KmhbpZuSGiA+7CKsbaIhuuPgnQ:rebn8RjEPPO2whbqSGZ+A7dYQ

Malware Config

Extracted

Family

redline

Botnet

@Garphin

C2

45.144.31.118:31905

Targets

    • Target

      JaffaCakes118_761c269ea1ce6959ec6819fda2e5b08a

    • Size

      809KB

    • MD5

      761c269ea1ce6959ec6819fda2e5b08a

    • SHA1

      1ab756adb35f3e9d7d2e6c776d2c4340340980d2

    • SHA256

      c176f607e4fa74adf107a43c13ebff55ed05482fee9c94353f1dff79924368af

    • SHA512

      097cc36146b7f58c45d107e28482e53db71c1636a2cd980b04090591440b60a0ddb19e22f2dda9a50ed40228e4bc9597d770f8ad3f7d2eb04712f6f9ad1c9ff9

    • SSDEEP

      12288:r5wbnUT3HRkUmGjEd1PxDdxKjJcm52Qr1KmhbpZuSGiA+7CKsbaIhuuPgnQ:rebn8RjEPPO2whbqSGZ+A7dYQ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks