Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10-01-2025 03:10
General
-
Target
JaffaCakes118_d959f9fb03b4106b3f6b5d92214dc360.exe
-
Size
366KB
-
MD5
d959f9fb03b4106b3f6b5d92214dc360
-
SHA1
c6c723f7f9e315a2631578aef08185909570e570
-
SHA256
fc3bf51e97f792149dfa59e214a20b00cff4eb11c8d0bb067e6af6a50e9b2d46
-
SHA512
7a499a0d3db006700c0abcdb6e8915ab04faabf29671df79adb2c05eb3e90a7e71b51d6b471b7a71137a41c8ccd65d592106991ac6bb1f5f1615ed9fcef814db
-
SSDEEP
6144:kvu6OkwK8F/mNVH7ZjlvfdvB3IG3TmNZgiU/FfgrjBLhqQpktXyS:QxOeDNvRnU97giU/FfyBLhqsuyS
Malware Config
Extracted
redline
sewPalp
185.215.113.29:24645
-
auth_value
41d3df6d093b1e36993abf16af0d6f2d
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Redline family
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 2 IoCs
-
Sectoprat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d959f9fb03b4106b3f6b5d92214dc360.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d959f9fb03b4106b3f6b5d92214dc360.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
204KB
-
Filesize
144KB
-
Filesize
18.8MB
-
Filesize
136KB
-
Filesize
1024KB