General

  • Target

    JaffaCakes118_79343afb16a49603333eb5142654e089

  • Size

    400KB

  • Sample

    250104-mmyvmavret

  • MD5

    79343afb16a49603333eb5142654e089

  • SHA1

    f9909d39378b80d0f5489a93be4e29a37bc2b9ba

  • SHA256

    2eb434b20a422a56a9e15b5e47cac3a913ca9feb6ad9af07eed877bd508783fa

  • SHA512

    46abbaff680df54e4f48df1b44fd03050bf33eeb4295ea702fa04d55c06f394c3cec18f82a26155b6d862a8728c139f37d26ce626919f94bb00285a466e448fa

  • SSDEEP

    3072:2t1M4TgHbVs58nNlvmHAFDTKT+dEjnNdvR48g7KMKyPZO6/F25e:204

Malware Config

Extracted

Family

redline

Botnet

@a0867183086d949f0c153b3bbcf46510

C2

212.86.102.118:22117

Targets

    • Target

      JaffaCakes118_79343afb16a49603333eb5142654e089

    • Size

      400KB

    • MD5

      79343afb16a49603333eb5142654e089

    • SHA1

      f9909d39378b80d0f5489a93be4e29a37bc2b9ba

    • SHA256

      2eb434b20a422a56a9e15b5e47cac3a913ca9feb6ad9af07eed877bd508783fa

    • SHA512

      46abbaff680df54e4f48df1b44fd03050bf33eeb4295ea702fa04d55c06f394c3cec18f82a26155b6d862a8728c139f37d26ce626919f94bb00285a466e448fa

    • SSDEEP

      3072:2t1M4TgHbVs58nNlvmHAFDTKT+dEjnNdvR48g7KMKyPZO6/F25e:204

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks