General

  • Target

    JaffaCakes118_852581bb8200c2b003360c5b60a309c9

  • Size

    842KB

  • Sample

    250108-cgqlys1meq

  • MD5

    852581bb8200c2b003360c5b60a309c9

  • SHA1

    de96c32392e002f8167538bb3d73655caa17c24a

  • SHA256

    8672f7cada4fe12b614d5e7c863c4d348a06645ef3ff3f64dfb0fce00eecb8ba

  • SHA512

    ba2d4ef1b61a38a3efb513f69cdc2ba386c2cbaafa3bd1a1dfcab26645b9083676ba2eff1896cac373a2287e30c35ef3a5569814219e8047d650324b59816ad2

  • SSDEEP

    12288:dMRIHX8gx4GJEHTZVWJFjDjKAmcR7fXJDMa5oSFhyw0GjVuaDthhg3EUKKT:II38s4GWGF2SFhyw06Hdg0UKKT

Malware Config

Extracted

Family

redline

Botnet

@qwait1

C2

145.239.32.179:27763

Attributes
  • auth_value

    6e134fbe11e1fba7052c029b94245b55

Targets

    • Target

      JaffaCakes118_852581bb8200c2b003360c5b60a309c9

    • Size

      842KB

    • MD5

      852581bb8200c2b003360c5b60a309c9

    • SHA1

      de96c32392e002f8167538bb3d73655caa17c24a

    • SHA256

      8672f7cada4fe12b614d5e7c863c4d348a06645ef3ff3f64dfb0fce00eecb8ba

    • SHA512

      ba2d4ef1b61a38a3efb513f69cdc2ba386c2cbaafa3bd1a1dfcab26645b9083676ba2eff1896cac373a2287e30c35ef3a5569814219e8047d650324b59816ad2

    • SSDEEP

      12288:dMRIHX8gx4GJEHTZVWJFjDjKAmcR7fXJDMa5oSFhyw0GjVuaDthhg3EUKKT:II38s4GWGF2SFhyw06Hdg0UKKT

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks