General

  • Target

    JaffaCakes118_c1848a9a9b4cc9d5b2d74ce1a9dacd5c

  • Size

    391KB

  • Sample

    250109-hhzh5sslay

  • MD5

    c1848a9a9b4cc9d5b2d74ce1a9dacd5c

  • SHA1

    d3ccd5473b776706a3f01fda8427cfaf3819b30f

  • SHA256

    223d7d8d26896d2e76d9ba68699e93e6c1f0ee486e5ce5aafc97430b2a4595cd

  • SHA512

    f950b0742bb5f3fa8ae3f45384df80eb8a4f0ed444885269e89f5991e7aa9dc7aa980031427fc7cbaf6448c5c4f5b6c23fc33d33d31a3bedf0e6f9438f9a8014

  • SSDEEP

    6144:KD3ay13MaA3RoZb6XOUP7e7T4g0GlOIpUEK2HRYPHcQgyyXjB:i3jwh2Cjq91kIpUE1HMHcQg5jB

Malware Config

Extracted

Family

redline

Botnet

build999

C2

77.232.40.127:8204

Attributes
  • auth_value

    275ce2c87153d4e8e3cc276c686a93de

Targets

    • Target

      JaffaCakes118_c1848a9a9b4cc9d5b2d74ce1a9dacd5c

    • Size

      391KB

    • MD5

      c1848a9a9b4cc9d5b2d74ce1a9dacd5c

    • SHA1

      d3ccd5473b776706a3f01fda8427cfaf3819b30f

    • SHA256

      223d7d8d26896d2e76d9ba68699e93e6c1f0ee486e5ce5aafc97430b2a4595cd

    • SHA512

      f950b0742bb5f3fa8ae3f45384df80eb8a4f0ed444885269e89f5991e7aa9dc7aa980031427fc7cbaf6448c5c4f5b6c23fc33d33d31a3bedf0e6f9438f9a8014

    • SSDEEP

      6144:KD3ay13MaA3RoZb6XOUP7e7T4g0GlOIpUEK2HRYPHcQgyyXjB:i3jwh2Cjq91kIpUE1HMHcQg5jB

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks