General

  • Target

    JaffaCakes118_c109356199373857ec9622f8c3e9d2fc

  • Size

    420KB

  • Sample

    250109-g3fq4a1nh1

  • MD5

    c109356199373857ec9622f8c3e9d2fc

  • SHA1

    8f3346f2862ef2aae9279e6282759c92b67593ed

  • SHA256

    767afdf78ec908e603571f83fcf5ee9004531377ab4272119c0fb460222bdde1

  • SHA512

    f1826b07d0f5a2d693751a18efbaaa28c152055bdbb5b52c41dd78c2d9d384f1cdb9f1d53a1e5b74d489bf9155afdff4d43962ae08225e13a672204862a7be8e

  • SSDEEP

    12288:6YeeqFP0Ha7g3d0CDwgkOdb2GnECaoSF4n:6YEFPQdJwvGnECZ

Malware Config

Extracted

Family

redline

Botnet

18.10

C2

185.215.113.17:9054

Attributes
  • auth_value

    094a20685023e19a7f873eb7c186be8c

Targets

    • Target

      JaffaCakes118_c109356199373857ec9622f8c3e9d2fc

    • Size

      420KB

    • MD5

      c109356199373857ec9622f8c3e9d2fc

    • SHA1

      8f3346f2862ef2aae9279e6282759c92b67593ed

    • SHA256

      767afdf78ec908e603571f83fcf5ee9004531377ab4272119c0fb460222bdde1

    • SHA512

      f1826b07d0f5a2d693751a18efbaaa28c152055bdbb5b52c41dd78c2d9d384f1cdb9f1d53a1e5b74d489bf9155afdff4d43962ae08225e13a672204862a7be8e

    • SSDEEP

      12288:6YeeqFP0Ha7g3d0CDwgkOdb2GnECaoSF4n:6YEFPQdJwvGnECZ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks