General

  • Target

    JaffaCakes118_8c4685d31c0c0b7930d912c8a5809f26

  • Size

    189KB

  • Sample

    250105-fc3mhatraq

  • MD5

    8c4685d31c0c0b7930d912c8a5809f26

  • SHA1

    7eb880d17172ed133fd7486ef569df2062a1d5ab

  • SHA256

    8c45d8458a5d2d7155ce7e55f38d607ae9d18808fb55707f992bd38d635bf571

  • SHA512

    26d299d308bda1b89a007e0fe418b654cae1f3592ebc8fbd2d8b80ad7bcc57a4d2a63dbcd4079f821187696f83a1b6c1af8e573540f0f926ce9a590f04fca97b

  • SSDEEP

    3072:SDKW1LgppLRHMY0TBfJvjcTp5XVsM0eu2yDqu5r:SDKW1Lgbdl0TBBvjc/6M6r

Malware Config

Extracted

Family

redline

Botnet

canadiancryptoaware

C2

86.105.252.27:46122

Targets

    • Target

      JaffaCakes118_8c4685d31c0c0b7930d912c8a5809f26

    • Size

      189KB

    • MD5

      8c4685d31c0c0b7930d912c8a5809f26

    • SHA1

      7eb880d17172ed133fd7486ef569df2062a1d5ab

    • SHA256

      8c45d8458a5d2d7155ce7e55f38d607ae9d18808fb55707f992bd38d635bf571

    • SHA512

      26d299d308bda1b89a007e0fe418b654cae1f3592ebc8fbd2d8b80ad7bcc57a4d2a63dbcd4079f821187696f83a1b6c1af8e573540f0f926ce9a590f04fca97b

    • SSDEEP

      3072:SDKW1LgppLRHMY0TBfJvjcTp5XVsM0eu2yDqu5r:SDKW1Lgbdl0TBBvjc/6M6r

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks