General

  • Target

    JaffaCakes118_d655f3e6670819c15a2621f6dff509cd

  • Size

    786KB

  • Sample

    250110-awvhcawkbt

  • MD5

    d655f3e6670819c15a2621f6dff509cd

  • SHA1

    078e1f074c485966f22873ea1b74b75e8e21bea0

  • SHA256

    d9d21350ab23cca7e46d77644e2bedd11fd4aa586be7984cc19973dbdef5937b

  • SHA512

    186719acee44be9e4c8265891bc730e4d5e9f99edd50b4185de518f142c2c0632ee466aa4a3eac85781921c6250c49c6a3045e80dadb78d9622b5deef465b29d

  • SSDEEP

    12288:PlWf2YJMmVmhpOq2WLq9mINAPZ0p6Ex9DL+T3EKn0E1Xcvl8i5RHOc:ddEFVmh5q9JWip6c9DLQExERct8i55Oc

Malware Config

Extracted

Family

redline

Botnet

CD

C2

205.185.127.47:20078

Attributes
  • auth_value

    30f7aa14039f9798fa5d76ec856ace04

Targets

    • Target

      JaffaCakes118_d655f3e6670819c15a2621f6dff509cd

    • Size

      786KB

    • MD5

      d655f3e6670819c15a2621f6dff509cd

    • SHA1

      078e1f074c485966f22873ea1b74b75e8e21bea0

    • SHA256

      d9d21350ab23cca7e46d77644e2bedd11fd4aa586be7984cc19973dbdef5937b

    • SHA512

      186719acee44be9e4c8265891bc730e4d5e9f99edd50b4185de518f142c2c0632ee466aa4a3eac85781921c6250c49c6a3045e80dadb78d9622b5deef465b29d

    • SSDEEP

      12288:PlWf2YJMmVmhpOq2WLq9mINAPZ0p6Ex9DL+T3EKn0E1Xcvl8i5RHOc:ddEFVmh5q9JWip6c9DLQExERct8i55Oc

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks