General

  • Target

    JaffaCakes118_f797238602d566305e4d253973d59fe7

  • Size

    403KB

  • Sample

    250111-flg26avnay

  • MD5

    f797238602d566305e4d253973d59fe7

  • SHA1

    8388db967451afa7dfa88ab39a9e29b585685d93

  • SHA256

    887343f0390d8f428ab749ca0edd11a233544acabc65cceb08617a4427f72dab

  • SHA512

    5df10e4fa8f9e5e085872b624409688b17a57ee11de4e6f2c9d2d8b12553c52d74ba7e589c182d85225b893972bef6af5d74918ac0df5989b0daef7b4f0dc485

  • SSDEEP

    6144:KK3eXBvSZ8+uTy9EZidyIj8dmPFuoKTZWDaU/mPkelGar8cYbU:KpBve8+u3AyIj8jltWDN/mZGar8VU

Malware Config

Extracted

Family

redline

Botnet

ww2ffrwd31fwww

C2

185.183.32.230:2912

Attributes
  • auth_value

    c26578dc9fbc2148513ef32d0021eb58

Targets

    • Target

      JaffaCakes118_f797238602d566305e4d253973d59fe7

    • Size

      403KB

    • MD5

      f797238602d566305e4d253973d59fe7

    • SHA1

      8388db967451afa7dfa88ab39a9e29b585685d93

    • SHA256

      887343f0390d8f428ab749ca0edd11a233544acabc65cceb08617a4427f72dab

    • SHA512

      5df10e4fa8f9e5e085872b624409688b17a57ee11de4e6f2c9d2d8b12553c52d74ba7e589c182d85225b893972bef6af5d74918ac0df5989b0daef7b4f0dc485

    • SSDEEP

      6144:KK3eXBvSZ8+uTy9EZidyIj8dmPFuoKTZWDaU/mPkelGar8cYbU:KpBve8+u3AyIj8jltWDN/mZGar8VU

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks