General

  • Target

    JaffaCakes118_9685144883ef51f77d801a7d721bd6b4

  • Size

    375KB

  • Sample

    250105-jz8c2szpbn

  • MD5

    9685144883ef51f77d801a7d721bd6b4

  • SHA1

    658a6a152a14c5926310472a92ebd259d597a0dc

  • SHA256

    b6cdb6651290591cfb555e80e0519098ffae63beeb7ab2890325f74048ae4357

  • SHA512

    f6434acf588ff014088af379e47cc7e44b89ab9ba31c88fdbd673d1c585970349979d36303ce4b7c919f5537cf1fc34a30ef22ad748aefbf137a8d4260da6f08

  • SSDEEP

    6144:gil5HTA/GAdgKIDm7YEuTkE3ys914oLPCycCpWUUxjMO:gijzAeAPIDm7ruhCc4oTBnpWUUBP

Malware Config

Extracted

Family

redline

C2

141.94.188.139:43059

Attributes
  • auth_value

    e6fd07a033474b6535552b6f7bfb4f97

Targets

    • Target

      JaffaCakes118_9685144883ef51f77d801a7d721bd6b4

    • Size

      375KB

    • MD5

      9685144883ef51f77d801a7d721bd6b4

    • SHA1

      658a6a152a14c5926310472a92ebd259d597a0dc

    • SHA256

      b6cdb6651290591cfb555e80e0519098ffae63beeb7ab2890325f74048ae4357

    • SHA512

      f6434acf588ff014088af379e47cc7e44b89ab9ba31c88fdbd673d1c585970349979d36303ce4b7c919f5537cf1fc34a30ef22ad748aefbf137a8d4260da6f08

    • SSDEEP

      6144:gil5HTA/GAdgKIDm7YEuTkE3ys914oLPCycCpWUUxjMO:gijzAeAPIDm7ruhCc4oTBnpWUUBP

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks