General

  • Target

    JaffaCakes118_d393c38d8c9c56a6c9d70a2ef743856e

  • Size

    309KB

  • Sample

    250109-129gkavmak

  • MD5

    d393c38d8c9c56a6c9d70a2ef743856e

  • SHA1

    9bab91cb60c2dde7b8e0f20128a31920c4e428fb

  • SHA256

    0f4702e0b8334a07e989bcfc93474c46bc8e4e0991f8e8ebc007b8776775d2b8

  • SHA512

    a9710fd098dd8186c9a37bdb37f1d7a1a232f1c6098a76edbb853bf438fd6ebb0d00c172bb87b27af66e801e6de92bd482b10e79240adb16ad27bb5c81ccbe5a

  • SSDEEP

    6144:ZuoGFgIZY7jRa+OKw5G3+2uRFRN0A2IpA4Nrsb85c:EqIZY7jRaMw5G3VufoA2aNp5

Malware Config

Extracted

Family

redline

Botnet

CASHSERVICE-111

C2

185.215.113.119:15548

Targets

    • Target

      JaffaCakes118_d393c38d8c9c56a6c9d70a2ef743856e

    • Size

      309KB

    • MD5

      d393c38d8c9c56a6c9d70a2ef743856e

    • SHA1

      9bab91cb60c2dde7b8e0f20128a31920c4e428fb

    • SHA256

      0f4702e0b8334a07e989bcfc93474c46bc8e4e0991f8e8ebc007b8776775d2b8

    • SHA512

      a9710fd098dd8186c9a37bdb37f1d7a1a232f1c6098a76edbb853bf438fd6ebb0d00c172bb87b27af66e801e6de92bd482b10e79240adb16ad27bb5c81ccbe5a

    • SSDEEP

      6144:ZuoGFgIZY7jRa+OKw5G3+2uRFRN0A2IpA4Nrsb85c:EqIZY7jRaMw5G3VufoA2aNp5

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks