General

  • Target

    JaffaCakes118_c7cf05f1079dd2bf79471934f8c1a2d2

  • Size

    792KB

  • Sample

    250109-pbjbxayrfw

  • MD5

    c7cf05f1079dd2bf79471934f8c1a2d2

  • SHA1

    d5add2d75a919a08acbbcf587d6ff70e678abc40

  • SHA256

    98317156797f48bfeeb042cf09478f8bf1ad017eab00a7e104a5014399261b89

  • SHA512

    31aafc4ef9427ba55251720b63a41001efd70673374db5aa4f2a6f84ffc0682f3c10845dbe398b88c5540a01238a0a3d86e1f7006ef108ee1ecc583b11e4fda3

  • SSDEEP

    12288:ctFXeVaamJ698+V5awYgInDfAuJ4B8UOdGf1g0cEOoDT8rPfo+Dykker:cDmx98+bt2nsb8JicEOokrPfoApx

Malware Config

Extracted

Family

redline

Botnet

@esc_recc

C2

95.181.152.5:46927

Attributes
  • auth_value

    cdf3919a262c0d6ba99116b375d7551c

Targets

    • Target

      JaffaCakes118_c7cf05f1079dd2bf79471934f8c1a2d2

    • Size

      792KB

    • MD5

      c7cf05f1079dd2bf79471934f8c1a2d2

    • SHA1

      d5add2d75a919a08acbbcf587d6ff70e678abc40

    • SHA256

      98317156797f48bfeeb042cf09478f8bf1ad017eab00a7e104a5014399261b89

    • SHA512

      31aafc4ef9427ba55251720b63a41001efd70673374db5aa4f2a6f84ffc0682f3c10845dbe398b88c5540a01238a0a3d86e1f7006ef108ee1ecc583b11e4fda3

    • SSDEEP

      12288:ctFXeVaamJ698+V5awYgInDfAuJ4B8UOdGf1g0cEOoDT8rPfo+Dykker:cDmx98+bt2nsb8JicEOokrPfoApx

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks