General

  • Target

    JaffaCakes118_c7fff52e3c354a16c161f2819d8644b3

  • Size

    971KB

  • Sample

    250109-ph79lszkdx

  • MD5

    c7fff52e3c354a16c161f2819d8644b3

  • SHA1

    6ae6372f71887425c245f4accc6f1161e7440c92

  • SHA256

    3468674a562551a1f3a2336726f96ab3ff963b2b8fb62fdf01fd1111aaaba0a5

  • SHA512

    4cf5c7dd375763ef6dac0084c5e5cdc7728bd7428f17fd671dab9024d215b6e1b8b90ca0a464d4539132e91dd1e198ea7384133fbd4b70e353c4b4f92a46b80a

  • SSDEEP

    12288:ZjgSKclWABNztbyV1/dLf3ZWNQYZuYZbrzMKo4Ni5PbKX5wd3pDyuWOd1LfsSM+0:rKqBSfhfOQEzaYv

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_c7fff52e3c354a16c161f2819d8644b3

    • Size

      971KB

    • MD5

      c7fff52e3c354a16c161f2819d8644b3

    • SHA1

      6ae6372f71887425c245f4accc6f1161e7440c92

    • SHA256

      3468674a562551a1f3a2336726f96ab3ff963b2b8fb62fdf01fd1111aaaba0a5

    • SHA512

      4cf5c7dd375763ef6dac0084c5e5cdc7728bd7428f17fd671dab9024d215b6e1b8b90ca0a464d4539132e91dd1e198ea7384133fbd4b70e353c4b4f92a46b80a

    • SSDEEP

      12288:ZjgSKclWABNztbyV1/dLf3ZWNQYZuYZbrzMKo4Ni5PbKX5wd3pDyuWOd1LfsSM+0:rKqBSfhfOQEzaYv

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks