General

  • Target

    JaffaCakes118_92d82660cf92570d51336a9af7f5a006

  • Size

    366KB

  • Sample

    250105-hrfsdswmgs

  • MD5

    92d82660cf92570d51336a9af7f5a006

  • SHA1

    af4f83fd67a5855160fa31f301e688843bd89eb0

  • SHA256

    019b1daa5d3d53e4dfe0741dd5d07e1904a8564b56a2e990e9036efb098f7a81

  • SHA512

    1f4c417bbc869100a1f4baf38ae86c0c7ee5fa657bbce43104d3faa42f85ae8c18eb27df0d26d88bbb3519f25bf5967d60767fe7e323e7274e63e9e5b9cb97f9

  • SSDEEP

    6144:7qjoLz/CifygH9QMN5+25yBkwLbKs4NBw1+/lOA7jBLYSsqOZEuG:xLz/CHHQ0BkSsjw1+/lOyBLYS/YnG

Malware Config

Extracted

Family

redline

Botnet

build777

C2

77.232.40.127:8204

Attributes
  • auth_value

    275ce2c87153d4e8e3cc276c686a93de

Targets

    • Target

      JaffaCakes118_92d82660cf92570d51336a9af7f5a006

    • Size

      366KB

    • MD5

      92d82660cf92570d51336a9af7f5a006

    • SHA1

      af4f83fd67a5855160fa31f301e688843bd89eb0

    • SHA256

      019b1daa5d3d53e4dfe0741dd5d07e1904a8564b56a2e990e9036efb098f7a81

    • SHA512

      1f4c417bbc869100a1f4baf38ae86c0c7ee5fa657bbce43104d3faa42f85ae8c18eb27df0d26d88bbb3519f25bf5967d60767fe7e323e7274e63e9e5b9cb97f9

    • SSDEEP

      6144:7qjoLz/CifygH9QMN5+25yBkwLbKs4NBw1+/lOA7jBLYSsqOZEuG:xLz/CHHQ0BkSsjw1+/lOyBLYS/YnG

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks