General

  • Target

    JaffaCakes118_9211ce6298b94bfb80c4c4750e5cc491

  • Size

    753KB

  • Sample

    250105-hgxcdswjhz

  • MD5

    9211ce6298b94bfb80c4c4750e5cc491

  • SHA1

    d799df21b865eec50e940cd45e7ca064adb3777d

  • SHA256

    0ba0e4522c1549a6f8e436003b2456411b6c1bc5eca438cc16996587fa06000d

  • SHA512

    5f154aeb8fd175b751570bad6aac21540ba2222ad14341d7975a967975a90ed529ff4b34af0521cb771c476c623bafa2440249e4df8d9d0f22728ecb0e429c34

  • SSDEEP

    12288:rG+TR9OytDyDhgmUfOutqbq3oO1xAFUgS2aU5PYQf72MbKwHz969ImgCnKxE+TA8:rPvEmKy1i/YQfqMbKwHz96CmDnUE+cc

Malware Config

Extracted

Family

redline

Botnet

@rrk0o

C2

95.216.43.58:40566

Attributes
  • auth_value

    fd7f71b079c843a407d5a0e4eb4dfa03

Targets

    • Target

      JaffaCakes118_9211ce6298b94bfb80c4c4750e5cc491

    • Size

      753KB

    • MD5

      9211ce6298b94bfb80c4c4750e5cc491

    • SHA1

      d799df21b865eec50e940cd45e7ca064adb3777d

    • SHA256

      0ba0e4522c1549a6f8e436003b2456411b6c1bc5eca438cc16996587fa06000d

    • SHA512

      5f154aeb8fd175b751570bad6aac21540ba2222ad14341d7975a967975a90ed529ff4b34af0521cb771c476c623bafa2440249e4df8d9d0f22728ecb0e429c34

    • SSDEEP

      12288:rG+TR9OytDyDhgmUfOutqbq3oO1xAFUgS2aU5PYQf72MbKwHz969ImgCnKxE+TA8:rPvEmKy1i/YQfqMbKwHz96CmDnUE+cc

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks