General

  • Target

    JaffaCakes118_996d4acd082f6c335b826dcfd6853bf8

  • Size

    308KB

  • Sample

    250108-lxskxsvme1

  • MD5

    996d4acd082f6c335b826dcfd6853bf8

  • SHA1

    e54c7364fece550ebd62e91f7cae048ec6f4c91e

  • SHA256

    11ee278e6045e6a74d8af0ca74296c919fdbb2264400040ee311be7152ce4300

  • SHA512

    27b2ac71667e0a58dd676726a844208c4d95c883dbb89982d7a86b110556b522a057fc9cdd6299389b020cb2bc5f91d655ed4f302f3d95cc483b45d6f3e34b48

  • SSDEEP

    6144:vHfzUm7M4hmHc+UDZeF5XY7gBkfQl36C17mDW5So:fLUm7Mir+UDZ0o7gBH390W5So

Malware Config

Extracted

Family

redline

Botnet

mix15.10

C2

185.215.113.15:57055

Attributes
  • auth_value

    408e5b97cb89314de620529179330c9a

Targets

    • Target

      JaffaCakes118_996d4acd082f6c335b826dcfd6853bf8

    • Size

      308KB

    • MD5

      996d4acd082f6c335b826dcfd6853bf8

    • SHA1

      e54c7364fece550ebd62e91f7cae048ec6f4c91e

    • SHA256

      11ee278e6045e6a74d8af0ca74296c919fdbb2264400040ee311be7152ce4300

    • SHA512

      27b2ac71667e0a58dd676726a844208c4d95c883dbb89982d7a86b110556b522a057fc9cdd6299389b020cb2bc5f91d655ed4f302f3d95cc483b45d6f3e34b48

    • SSDEEP

      6144:vHfzUm7M4hmHc+UDZeF5XY7gBkfQl36C17mDW5So:fLUm7Mir+UDZ0o7gBH390W5So

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks