General

  • Target

    48a90e3f706133d01bba637413e1535b_JaffaCakes118

  • Size

    284KB

  • Sample

    241015-s8dpgaxbkm

  • MD5

    48a90e3f706133d01bba637413e1535b

  • SHA1

    bb7f1b7a46099da38c229039f5156ecd0d1fcb4f

  • SHA256

    71acec8cf108ed30bdc2d7049bee00a159d67e8fade2ef53d575864ba6bc237b

  • SHA512

    fd7ed2d9460ed9b279a30f6d5ca289c83d7521b178d3dca689feeb016505701f7d5d0022ee97637a2721a018fa3a81f6221a88c02c6491e4b395f9b14e88d619

  • SSDEEP

    6144:Linf9ZFyO/MdaMVASRcdOULl9LmdpLBVccPI13/4BXuSzC/:+nf9XntSR9A9Lmdp9VrI13/4BDC/

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.20:13441

Targets

    • Target

      48a90e3f706133d01bba637413e1535b_JaffaCakes118

    • Size

      284KB

    • MD5

      48a90e3f706133d01bba637413e1535b

    • SHA1

      bb7f1b7a46099da38c229039f5156ecd0d1fcb4f

    • SHA256

      71acec8cf108ed30bdc2d7049bee00a159d67e8fade2ef53d575864ba6bc237b

    • SHA512

      fd7ed2d9460ed9b279a30f6d5ca289c83d7521b178d3dca689feeb016505701f7d5d0022ee97637a2721a018fa3a81f6221a88c02c6491e4b395f9b14e88d619

    • SSDEEP

      6144:Linf9ZFyO/MdaMVASRcdOULl9LmdpLBVccPI13/4BXuSzC/:+nf9XntSR9A9Lmdp9VrI13/4BDC/

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks