General

  • Target

    JaffaCakes118_a7a937593d0f8c4b4071a976333ee5c2

  • Size

    757KB

  • Sample

    250108-x4nfbssmdj

  • MD5

    a7a937593d0f8c4b4071a976333ee5c2

  • SHA1

    ab9ddfc19ad9f4a29acdfffef8c61fe0bac1b15c

  • SHA256

    19decfd7c08e3a632b3c455644f746b973c56ab4c66cf0acad872bf032539193

  • SHA512

    591af5fb37ee86549def30b5b76a9e023827fb823ba29e7a3edafca9d2345ed244fcbf0e80d9854605d05ca7f3bd82caaab5ac7622c617acfe208346915990b1

  • SSDEEP

    12288:0nvTV/+mrJw9n1x2RiwKBG54XDPRkUvp351vgOs30IaxQmTlQeHISZM3T:mJ/juXkSNPrgJEVWmK53T

Malware Config

Extracted

Family

redline

Botnet

@kla1z

C2

92.119.113.189:21746

Attributes
  • auth_value

    de713911efa818890ac36085c9a0fc58

Targets

    • Target

      JaffaCakes118_a7a937593d0f8c4b4071a976333ee5c2

    • Size

      757KB

    • MD5

      a7a937593d0f8c4b4071a976333ee5c2

    • SHA1

      ab9ddfc19ad9f4a29acdfffef8c61fe0bac1b15c

    • SHA256

      19decfd7c08e3a632b3c455644f746b973c56ab4c66cf0acad872bf032539193

    • SHA512

      591af5fb37ee86549def30b5b76a9e023827fb823ba29e7a3edafca9d2345ed244fcbf0e80d9854605d05ca7f3bd82caaab5ac7622c617acfe208346915990b1

    • SSDEEP

      12288:0nvTV/+mrJw9n1x2RiwKBG54XDPRkUvp351vgOs30IaxQmTlQeHISZM3T:mJ/juXkSNPrgJEVWmK53T

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks