General

  • Target

    JaffaCakes118_3d932af1163a1b2c220051e1400b1384

  • Size

    407KB

  • Sample

    241231-27wckatrgy

  • MD5

    3d932af1163a1b2c220051e1400b1384

  • SHA1

    ecc532ee5950375ccd316307c791e8fa5381fb4f

  • SHA256

    42e2e28c131c86f381c8ef54ff237df75e560b798902fd1b49c5aeedfd10eaae

  • SHA512

    f655338083e7c20f926f36c3ee89408a6c39bdc1c9946ac299c5c7ef85452d5c57a4b9ed4f5514ef0d483f2d7bafc8e5f9c56b2aef67fb93564f06cb29daa1af

  • SSDEEP

    6144:B/VCybEr9/AEqTiEtNGOCgl3hxed4BSu62IdqtN7yGWMmlCri:B/rM5qGEtNnCglRcd4BF6z473WMdi

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_3d932af1163a1b2c220051e1400b1384

    • Size

      407KB

    • MD5

      3d932af1163a1b2c220051e1400b1384

    • SHA1

      ecc532ee5950375ccd316307c791e8fa5381fb4f

    • SHA256

      42e2e28c131c86f381c8ef54ff237df75e560b798902fd1b49c5aeedfd10eaae

    • SHA512

      f655338083e7c20f926f36c3ee89408a6c39bdc1c9946ac299c5c7ef85452d5c57a4b9ed4f5514ef0d483f2d7bafc8e5f9c56b2aef67fb93564f06cb29daa1af

    • SSDEEP

      6144:B/VCybEr9/AEqTiEtNGOCgl3hxed4BSu62IdqtN7yGWMmlCri:B/rM5qGEtNnCglRcd4BF6z473WMdi

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks