General

  • Target

    3512f658e4cd761c5966dabd590bccc3_JaffaCakes118

  • Size

    362KB

  • Sample

    241011-qx3hcazepq

  • MD5

    3512f658e4cd761c5966dabd590bccc3

  • SHA1

    d47dee37fd097e066b08e84d3c2b256836a86ddc

  • SHA256

    2a028dd9053cca3d80b4a9a2329d7031f5e09fbda27d858872f1eb12fc41fe25

  • SHA512

    c35d80a67903e435c1668da226e51796a5a932c3c7a323b0717f9bb362745bde8617e5a80836fdf6f36fe39d8fd000a8002cc4fde83bf1d50704437db2a0ebb7

  • SSDEEP

    6144:ANIOABgGL3KK2D5h9WcvHPvf/UVvigm7/Ym4Q2of+Gu+9wn:ANhEgc3KV5h9ff//c0wm4Q2onN9wn

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      3512f658e4cd761c5966dabd590bccc3_JaffaCakes118

    • Size

      362KB

    • MD5

      3512f658e4cd761c5966dabd590bccc3

    • SHA1

      d47dee37fd097e066b08e84d3c2b256836a86ddc

    • SHA256

      2a028dd9053cca3d80b4a9a2329d7031f5e09fbda27d858872f1eb12fc41fe25

    • SHA512

      c35d80a67903e435c1668da226e51796a5a932c3c7a323b0717f9bb362745bde8617e5a80836fdf6f36fe39d8fd000a8002cc4fde83bf1d50704437db2a0ebb7

    • SSDEEP

      6144:ANIOABgGL3KK2D5h9WcvHPvf/UVvigm7/Ym4Q2of+Gu+9wn:ANhEgc3KV5h9ff//c0wm4Q2onN9wn

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks