General

  • Target

    JaffaCakes118_cc21667b01db651357e48ef42b810f97

  • Size

    782KB

  • Sample

    250109-s8w6tatmbw

  • MD5

    cc21667b01db651357e48ef42b810f97

  • SHA1

    eb74c31490ebe9455fc3ad3bd6b52663f2f0e489

  • SHA256

    f81e1f8605323fddc2b95c8f1508ae8f683da1aae86c4b402436e8e50a0b1ff0

  • SHA512

    137a4065b72acf5ebcafa181456c863b27623cbeb245b3188fc73a640f12b2f84ee65504450f57b02605e16ce6c25ac338dbc9322e7f38e7655aac688a554cbb

  • SSDEEP

    12288:dR1fu35cNcIZ2Su86wY2KX7CRDtBOkIBr7ywf20V0YLmHCdMaPEYw+8s:V4iNcIZolUIxyh0jXR78s

Malware Config

Extracted

Family

redline

Botnet

@Karkogfd

C2

176.31.32.198:17055

Attributes
  • auth_value

    5d0a654aa77e883b8d4f1144b0955e9b

Targets

    • Target

      JaffaCakes118_cc21667b01db651357e48ef42b810f97

    • Size

      782KB

    • MD5

      cc21667b01db651357e48ef42b810f97

    • SHA1

      eb74c31490ebe9455fc3ad3bd6b52663f2f0e489

    • SHA256

      f81e1f8605323fddc2b95c8f1508ae8f683da1aae86c4b402436e8e50a0b1ff0

    • SHA512

      137a4065b72acf5ebcafa181456c863b27623cbeb245b3188fc73a640f12b2f84ee65504450f57b02605e16ce6c25ac338dbc9322e7f38e7655aac688a554cbb

    • SSDEEP

      12288:dR1fu35cNcIZ2Su86wY2KX7CRDtBOkIBr7ywf20V0YLmHCdMaPEYw+8s:V4iNcIZolUIxyh0jXR78s

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks