General

  • Target

    JaffaCakes118_e0941b63af863bb26dd82dafe08a5c27

  • Size

    149KB

  • Sample

    250110-lapwhszmb1

  • MD5

    e0941b63af863bb26dd82dafe08a5c27

  • SHA1

    51faa91dc2e12a637d2f9aa397d4ae512a591ba5

  • SHA256

    e74ed2209bc94f38ef5c90e655bbe8c34ddc0dd6b5c0b60ce14ee4f8aeac928a

  • SHA512

    3f990edb05272b3050e190b58c642e667c6a03656178282155a257bcbe29b29a12dfa126195224ddc99eefb4c21d35deced878ca1f98d2863f5b0a8cdbd99695

  • SSDEEP

    3072:pLmaHPp7bacwTQlc2p4z/Xo/27aAEY82M3aSJF8:pL3xbpwOJ4/40j37

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_e0941b63af863bb26dd82dafe08a5c27

    • Size

      149KB

    • MD5

      e0941b63af863bb26dd82dafe08a5c27

    • SHA1

      51faa91dc2e12a637d2f9aa397d4ae512a591ba5

    • SHA256

      e74ed2209bc94f38ef5c90e655bbe8c34ddc0dd6b5c0b60ce14ee4f8aeac928a

    • SHA512

      3f990edb05272b3050e190b58c642e667c6a03656178282155a257bcbe29b29a12dfa126195224ddc99eefb4c21d35deced878ca1f98d2863f5b0a8cdbd99695

    • SSDEEP

      3072:pLmaHPp7bacwTQlc2p4z/Xo/27aAEY82M3aSJF8:pL3xbpwOJ4/40j37

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks