General

  • Target

    JaffaCakes118_c72f78d8a57bfd8b32b8063193b0ff23

  • Size

    840KB

  • Sample

    250109-nrspvayncz

  • MD5

    c72f78d8a57bfd8b32b8063193b0ff23

  • SHA1

    89e78022ba24fbc30fd7699bd9a447c892b4ce30

  • SHA256

    0694d1c096079189e753ea32b226281a82e79e75a7909d3798c2b31a7f2ddf9f

  • SHA512

    420c1791fe3cd54f20d462ba0873ef67140306dc1338905ec5457e44cf07da64a3b07e0559e31e26027540366273bd9c2926c7ebf713bb0048ce2020ccbd1d51

  • SSDEEP

    12288:wtVPZmfzxngrj4Oi0q/VrhZndYEGVD7pGYoWe+FGfc/MKQY6T31VAzyoD9r7:QBAHpRSSWBFgckKQQOGn

Malware Config

Extracted

Family

redline

Botnet

@tupa187

C2

95.181.152.5:46927

Attributes
  • auth_value

    cdf3919a262c0d6ba99116b375d7551c

Targets

    • Target

      JaffaCakes118_c72f78d8a57bfd8b32b8063193b0ff23

    • Size

      840KB

    • MD5

      c72f78d8a57bfd8b32b8063193b0ff23

    • SHA1

      89e78022ba24fbc30fd7699bd9a447c892b4ce30

    • SHA256

      0694d1c096079189e753ea32b226281a82e79e75a7909d3798c2b31a7f2ddf9f

    • SHA512

      420c1791fe3cd54f20d462ba0873ef67140306dc1338905ec5457e44cf07da64a3b07e0559e31e26027540366273bd9c2926c7ebf713bb0048ce2020ccbd1d51

    • SSDEEP

      12288:wtVPZmfzxngrj4Oi0q/VrhZndYEGVD7pGYoWe+FGfc/MKQY6T31VAzyoD9r7:QBAHpRSSWBFgckKQQOGn

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks