General

  • Target

    JaffaCakes118_ff29e312334b57287a6521cf14836984

  • Size

    855KB

  • Sample

    250111-mvzrwszlfq

  • MD5

    ff29e312334b57287a6521cf14836984

  • SHA1

    609d0da94ea8bbd4cd94855fb333a1eadc5967f2

  • SHA256

    115c76d821e1e8028eb87095afde1e2fd432c0cf9f160e48578e934aa38977bd

  • SHA512

    385f766d6f630b7317ada241229d9ca79efb5dbdf425adf756274710aca292f72fa1632e526ce67f2decae344c899923426747d40df95f0a500d4e470b19c667

  • SSDEEP

    24576:NFBtDmh54SqHX5AJ5IRqWYUqjLyxnPPTUYs8KC:N1DmhLsX8WXYUq/yxnH4Fw

Malware Config

Extracted

Family

redline

Botnet

@hatake03

C2

95.181.152.6:46927

Attributes
  • auth_value

    cdf3919a262c0d6ba99116b375d7551c

Targets

    • Target

      JaffaCakes118_ff29e312334b57287a6521cf14836984

    • Size

      855KB

    • MD5

      ff29e312334b57287a6521cf14836984

    • SHA1

      609d0da94ea8bbd4cd94855fb333a1eadc5967f2

    • SHA256

      115c76d821e1e8028eb87095afde1e2fd432c0cf9f160e48578e934aa38977bd

    • SHA512

      385f766d6f630b7317ada241229d9ca79efb5dbdf425adf756274710aca292f72fa1632e526ce67f2decae344c899923426747d40df95f0a500d4e470b19c667

    • SSDEEP

      24576:NFBtDmh54SqHX5AJ5IRqWYUqjLyxnPPTUYs8KC:N1DmhLsX8WXYUq/yxnH4Fw

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks