General

  • Target

    d93b347e1543eeda2b89bd7cc0b1505e_JaffaCakes118

  • Size

    314KB

  • Sample

    241209-mvn1dsvmhw

  • MD5

    d93b347e1543eeda2b89bd7cc0b1505e

  • SHA1

    2f9f02514760e6a53eadaf464844cb732f45389f

  • SHA256

    753193d3e769252ddc70b41a8405166dc99e7c33586b14910158a8265c7f2650

  • SHA512

    03f10dc12a2ccfe21a4cbf013f6f6b7ce0a5e82dc62d7751aa17ab3835935fd69c37d0476b76a2b1ad9dc52f4225786c762c4910a6cc6f9224ed09debc592150

  • SSDEEP

    6144:Pek+FeYyeyDsLsqciihb12hCvzg8XVsC1OePvYfS7zLLZdiyrZ+yXUyK:Pvw/yeyAcICdVs05PcS7zv3DZtE

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      d93b347e1543eeda2b89bd7cc0b1505e_JaffaCakes118

    • Size

      314KB

    • MD5

      d93b347e1543eeda2b89bd7cc0b1505e

    • SHA1

      2f9f02514760e6a53eadaf464844cb732f45389f

    • SHA256

      753193d3e769252ddc70b41a8405166dc99e7c33586b14910158a8265c7f2650

    • SHA512

      03f10dc12a2ccfe21a4cbf013f6f6b7ce0a5e82dc62d7751aa17ab3835935fd69c37d0476b76a2b1ad9dc52f4225786c762c4910a6cc6f9224ed09debc592150

    • SSDEEP

      6144:Pek+FeYyeyDsLsqciihb12hCvzg8XVsC1OePvYfS7zLLZdiyrZ+yXUyK:Pvw/yeyAcICdVs05PcS7zv3DZtE

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks