General

  • Target

    JaffaCakes118_96f9bbf514e13282396805369ab8e6a5

  • Size

    386KB

  • Sample

    250108-ktrc1svphp

  • MD5

    96f9bbf514e13282396805369ab8e6a5

  • SHA1

    94d77146beb1adc047b8087b43e2b6562a5cfa93

  • SHA256

    bd04d378d84ef16014e8c64d7c239300ff0fea4cdd9b48e4b83e67c494d9b5f2

  • SHA512

    d2a5d6a104ba0f12c0bd1dfc85b755eca61d8349e2eb94163b544ebf205ccc2ffc8b8583acfad30195ec351c237ab3b78362d2e49873b3281fa801864a523b28

  • SSDEEP

    6144:/QBuG+S5u/dZJk70Vs5FER6vimTrtlRzkLZ7u7cI1L1v:GuG1IM7b5eR66mPtl2Z7uYuZ

Malware Config

Extracted

Family

redline

Botnet

usamoney

C2

45.142.215.47:27643

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Targets

    • Target

      JaffaCakes118_96f9bbf514e13282396805369ab8e6a5

    • Size

      386KB

    • MD5

      96f9bbf514e13282396805369ab8e6a5

    • SHA1

      94d77146beb1adc047b8087b43e2b6562a5cfa93

    • SHA256

      bd04d378d84ef16014e8c64d7c239300ff0fea4cdd9b48e4b83e67c494d9b5f2

    • SHA512

      d2a5d6a104ba0f12c0bd1dfc85b755eca61d8349e2eb94163b544ebf205ccc2ffc8b8583acfad30195ec351c237ab3b78362d2e49873b3281fa801864a523b28

    • SSDEEP

      6144:/QBuG+S5u/dZJk70Vs5FER6vimTrtlRzkLZ7u7cI1L1v:GuG1IM7b5eR66mPtl2Z7uYuZ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks