General

  • Target

    JaffaCakes118_1c162480c74f53709433b205c33a64f9

  • Size

    768KB

  • Sample

    250106-llakzatjgy

  • MD5

    1c162480c74f53709433b205c33a64f9

  • SHA1

    2b63069a91e38353117792e9627735c8c512b649

  • SHA256

    7b5c24d67f9c258ebacbf3fad76c8addae8cde74be27b061410e02188a684685

  • SHA512

    5af424cd55d4265f62c1b0e5fa7d510295b580a83148c5d852fb7d2c4fc669e63b2fc409c58e883712f54c8eae371b0515403e89302afd55c4379611906ab831

  • SSDEEP

    12288:1paoy89TKFdcgviDi01Of+xLsdG2pjiTxUlJ8LEKShOMyMryAU9XdHTSczcBFkHn:1UzRb7W+hJ0r8yM9wdzSczcBFkHn

Malware Config

Extracted

Family

redline

Botnet

@Durak9876

C2

95.181.152.5:46927

Attributes
  • auth_value

    cdf3919a262c0d6ba99116b375d7551c

Targets

    • Target

      JaffaCakes118_1c162480c74f53709433b205c33a64f9

    • Size

      768KB

    • MD5

      1c162480c74f53709433b205c33a64f9

    • SHA1

      2b63069a91e38353117792e9627735c8c512b649

    • SHA256

      7b5c24d67f9c258ebacbf3fad76c8addae8cde74be27b061410e02188a684685

    • SHA512

      5af424cd55d4265f62c1b0e5fa7d510295b580a83148c5d852fb7d2c4fc669e63b2fc409c58e883712f54c8eae371b0515403e89302afd55c4379611906ab831

    • SSDEEP

      12288:1paoy89TKFdcgviDi01Of+xLsdG2pjiTxUlJ8LEKShOMyMryAU9XdHTSczcBFkHn:1UzRb7W+hJ0r8yM9wdzSczcBFkHn

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks