General

  • Target

    JaffaCakes118_c73df489729368595025367f5ef9b7f8

  • Size

    843KB

  • Sample

    250109-ns4hqs1lhn

  • MD5

    c73df489729368595025367f5ef9b7f8

  • SHA1

    30b330df76c1531e82597c3444a9868643d287b1

  • SHA256

    e83fb2d9e21466ba8bd7d3627ad453163b93bc15231acdde5f7e8dfea20703e0

  • SHA512

    81404f933e4c570dcb498d3572312b37e6ca3f0102ef4b6c54224c5b88ddfd496d47bdbfec9bf3ea9469b3c3ad64c621bf2d2c16593060bd82499a23e18d21f6

  • SSDEEP

    12288:pgDF7wJsMfW3gp6S3Gnk9dZhjGD/VUIFgGoImAoblPAKaeHZI3si07Bi8/T4D6dh:0Ys2qgpX3R3q/VTuZRPd5WtaCUh

Malware Config

Extracted

Family

redline

Botnet

@Lumexyy

C2

145.239.32.179:27763

Attributes
  • auth_value

    6e134fbe11e1fba7052c029b94245b55

Targets

    • Target

      JaffaCakes118_c73df489729368595025367f5ef9b7f8

    • Size

      843KB

    • MD5

      c73df489729368595025367f5ef9b7f8

    • SHA1

      30b330df76c1531e82597c3444a9868643d287b1

    • SHA256

      e83fb2d9e21466ba8bd7d3627ad453163b93bc15231acdde5f7e8dfea20703e0

    • SHA512

      81404f933e4c570dcb498d3572312b37e6ca3f0102ef4b6c54224c5b88ddfd496d47bdbfec9bf3ea9469b3c3ad64c621bf2d2c16593060bd82499a23e18d21f6

    • SSDEEP

      12288:pgDF7wJsMfW3gp6S3Gnk9dZhjGD/VUIFgGoImAoblPAKaeHZI3si07Bi8/T4D6dh:0Ys2qgpX3R3q/VTuZRPd5WtaCUh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks