General

  • Target

    JaffaCakes118_634de05a3d72eebdc68f3b57068a5ce8

  • Size

    367KB

  • Sample

    250107-pvbq6s1pas

  • MD5

    634de05a3d72eebdc68f3b57068a5ce8

  • SHA1

    f2e8f4378dfd43aa9d570bf72c5f2d2ee3a715f2

  • SHA256

    b3d5eedfc393d281556efae0696e0230e56594edf42025c103426bddc2200271

  • SHA512

    ef623676e9bd92ba9b04ccd2a38f7f274b8895c8ed9a69c347ad858d7a4373fb1284e6a1eee4be37bef969e0987f99f65baed4c755f67d18520c96811b937a66

  • SSDEEP

    6144:O2yGi46Bq/kHtGjHyfXZkWk0laUGOq6KF3dNwqjr/fcmmsBfftHt:die/syWOOZK/mqjr/fasBfFN

Malware Config

Extracted

Family

redline

Botnet

shop

C2

45.9.20.107:46187

Attributes
  • auth_value

    60c75f1e2d31f6bac6dd7edad67d8615

Targets

    • Target

      JaffaCakes118_634de05a3d72eebdc68f3b57068a5ce8

    • Size

      367KB

    • MD5

      634de05a3d72eebdc68f3b57068a5ce8

    • SHA1

      f2e8f4378dfd43aa9d570bf72c5f2d2ee3a715f2

    • SHA256

      b3d5eedfc393d281556efae0696e0230e56594edf42025c103426bddc2200271

    • SHA512

      ef623676e9bd92ba9b04ccd2a38f7f274b8895c8ed9a69c347ad858d7a4373fb1284e6a1eee4be37bef969e0987f99f65baed4c755f67d18520c96811b937a66

    • SSDEEP

      6144:O2yGi46Bq/kHtGjHyfXZkWk0laUGOq6KF3dNwqjr/fcmmsBfftHt:die/syWOOZK/mqjr/fasBfFN

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks