General

  • Target

    JaffaCakes118_024e8e19468947e14692437eeec093a8

  • Size

    794KB

  • Sample

    250105-3vttmsyrf1

  • MD5

    024e8e19468947e14692437eeec093a8

  • SHA1

    f2034dad6414262d0986165a93b471af4f96602c

  • SHA256

    ecafea6473923c6c5f47978821cd1548254a8f956865cf76ecdd008eab2fcae8

  • SHA512

    d117d513a2489d39837ac879cf766cc097bb1abeed75cf71af86e8bac6c34a44b980c5f50c34c8844f77d9a9652b71d793b835a4c734d2096f7ba9d3ddf230d0

  • SSDEEP

    12288:MejqLHQTqmvRokC9PHUBYOTIYk+PrPv7EZW8hcxMFYUw9X6Iq+9heGjxMDzhAzoQ:nwOquRokC9/FBq8OeFYzAIocxGmz/

Malware Config

Extracted

Family

redline

Botnet

@steeladm

C2

95.181.152.6:46927

Attributes
  • auth_value

    cdf3919a262c0d6ba99116b375d7551c

Targets

    • Target

      JaffaCakes118_024e8e19468947e14692437eeec093a8

    • Size

      794KB

    • MD5

      024e8e19468947e14692437eeec093a8

    • SHA1

      f2034dad6414262d0986165a93b471af4f96602c

    • SHA256

      ecafea6473923c6c5f47978821cd1548254a8f956865cf76ecdd008eab2fcae8

    • SHA512

      d117d513a2489d39837ac879cf766cc097bb1abeed75cf71af86e8bac6c34a44b980c5f50c34c8844f77d9a9652b71d793b835a4c734d2096f7ba9d3ddf230d0

    • SSDEEP

      12288:MejqLHQTqmvRokC9PHUBYOTIYk+PrPv7EZW8hcxMFYUw9X6Iq+9heGjxMDzhAzoQ:nwOquRokC9/FBq8OeFYzAIocxGmz/

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks