General

  • Target

    JaffaCakes118_950bf926fdadae0adcf698dc3b8bb590

  • Size

    801KB

  • Sample

    250108-j4njfatpar

  • MD5

    950bf926fdadae0adcf698dc3b8bb590

  • SHA1

    aaa3f2207f075acc55ac1468c0dc2287bf74f86e

  • SHA256

    437cb513fd555efe435edc0aa31009b50027e3f5fdbf4fcfedfdb265135257d4

  • SHA512

    df6c05f3e2566dc59e4768149b5161d4d4a69f4ba4a6c12629413c9e9b16ef46cb3a8099206c02a36505bd80136225d3bd715213f523f8587e90ff2410aea855

  • SSDEEP

    12288:CmL6OLkeOTHxQyJ2xunVSVAWholvnnUSdj7plPBXYr7jAoZMpjxV8+qk+:CmVROT74gVuqndj7/tYr7jAm8xV8Rk+

Malware Config

Extracted

Family

redline

Botnet

@tupa187

C2

95.181.152.5:46927

Attributes
  • auth_value

    cdf3919a262c0d6ba99116b375d7551c

Targets

    • Target

      JaffaCakes118_950bf926fdadae0adcf698dc3b8bb590

    • Size

      801KB

    • MD5

      950bf926fdadae0adcf698dc3b8bb590

    • SHA1

      aaa3f2207f075acc55ac1468c0dc2287bf74f86e

    • SHA256

      437cb513fd555efe435edc0aa31009b50027e3f5fdbf4fcfedfdb265135257d4

    • SHA512

      df6c05f3e2566dc59e4768149b5161d4d4a69f4ba4a6c12629413c9e9b16ef46cb3a8099206c02a36505bd80136225d3bd715213f523f8587e90ff2410aea855

    • SSDEEP

      12288:CmL6OLkeOTHxQyJ2xunVSVAWholvnnUSdj7plPBXYr7jAoZMpjxV8+qk+:CmVROT74gVuqndj7/tYr7jAm8xV8Rk+

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks