General

  • Target

    JaffaCakes118_e510f4dd446b1be9cb2ac89f9a40efb5

  • Size

    802KB

  • Sample

    250110-qcx25axkfr

  • MD5

    e510f4dd446b1be9cb2ac89f9a40efb5

  • SHA1

    b0d0b2c09f68bcbeea55c4bb578ed73cd01b4a28

  • SHA256

    fe6ec55eb383a61725615537de96e54f118f50a34148acab96032ed92ebcf2ce

  • SHA512

    11d5da1a83f636ea32e2e7afc7710c44f6d120b654833519197a925b6a37cc290721326a9e1d1527871e880939512f6852df3a9334a5df00c4505abeb912e3e6

  • SSDEEP

    12288:jlfH1UiwPYTaL73CTPpBtWiTN6VJcUEPaBO9bLd6zBj4Qt4NZO6/LMOPVHfSQ:hf1aPYTbTtvqEP2OmZGHOOAKHfSQ

Malware Config

Extracted

Family

redline

Botnet

@perfectworldz

C2

95.181.152.5:46927

Attributes
  • auth_value

    cdf3919a262c0d6ba99116b375d7551c

Targets

    • Target

      JaffaCakes118_e510f4dd446b1be9cb2ac89f9a40efb5

    • Size

      802KB

    • MD5

      e510f4dd446b1be9cb2ac89f9a40efb5

    • SHA1

      b0d0b2c09f68bcbeea55c4bb578ed73cd01b4a28

    • SHA256

      fe6ec55eb383a61725615537de96e54f118f50a34148acab96032ed92ebcf2ce

    • SHA512

      11d5da1a83f636ea32e2e7afc7710c44f6d120b654833519197a925b6a37cc290721326a9e1d1527871e880939512f6852df3a9334a5df00c4505abeb912e3e6

    • SSDEEP

      12288:jlfH1UiwPYTaL73CTPpBtWiTN6VJcUEPaBO9bLd6zBj4Qt4NZO6/LMOPVHfSQ:hf1aPYTbTtvqEP2OmZGHOOAKHfSQ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks