General

  • Target

    JaffaCakes118_8252e89dbef5b5cfe162eccf972aca26

  • Size

    221KB

  • Sample

    250108-bayhjswrc1

  • MD5

    8252e89dbef5b5cfe162eccf972aca26

  • SHA1

    24c45450aa5ea6bbe1716786b111cba88fd7ae01

  • SHA256

    0c0706ad6f09f1df63761b746393e8d8e953ebfac90ea096421767482485084d

  • SHA512

    e4333763698ac9a8ef03fc61c6d64a1fc583c7c4d6717dee3ba9cbcd1887d9b295306477b7520356f831e76f80107e0fc3eabe20120d846f28d88d459644a717

  • SSDEEP

    3072:BLY7ICbXn4py0QdkqW0liZupX6LcFr1pE2ffMjUeEUciiJG8p:FY0r40CqcFpgEU2P

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_8252e89dbef5b5cfe162eccf972aca26

    • Size

      221KB

    • MD5

      8252e89dbef5b5cfe162eccf972aca26

    • SHA1

      24c45450aa5ea6bbe1716786b111cba88fd7ae01

    • SHA256

      0c0706ad6f09f1df63761b746393e8d8e953ebfac90ea096421767482485084d

    • SHA512

      e4333763698ac9a8ef03fc61c6d64a1fc583c7c4d6717dee3ba9cbcd1887d9b295306477b7520356f831e76f80107e0fc3eabe20120d846f28d88d459644a717

    • SSDEEP

      3072:BLY7ICbXn4py0QdkqW0liZupX6LcFr1pE2ffMjUeEUciiJG8p:FY0r40CqcFpgEU2P

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks