General

  • Target

    JaffaCakes118_067dbe9c3f005b578f344cac031b5d55

  • Size

    417KB

  • Sample

    241231-f3x5pszlez

  • MD5

    067dbe9c3f005b578f344cac031b5d55

  • SHA1

    cbafa063ba0ed5cfc5cc2ec8642cecb0cf6a7c7d

  • SHA256

    d982e910288e60d16cedd9f1066de06af5ac50f8cad38d4381c45498c6202e7b

  • SHA512

    43489a8f4b1194ab8f0177f9d92494ab3166dc1ad752683880c1bf8a55af0dc5f97357e3710d1ad9404310fecb31867d0c8e7d0a62feffdfbc26fefb943190f1

  • SSDEEP

    12288:XVX2hB3zhyaD44kjnXXLkdoOGYH6p9SsP:XoB39yn48XkGYH6n

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_067dbe9c3f005b578f344cac031b5d55

    • Size

      417KB

    • MD5

      067dbe9c3f005b578f344cac031b5d55

    • SHA1

      cbafa063ba0ed5cfc5cc2ec8642cecb0cf6a7c7d

    • SHA256

      d982e910288e60d16cedd9f1066de06af5ac50f8cad38d4381c45498c6202e7b

    • SHA512

      43489a8f4b1194ab8f0177f9d92494ab3166dc1ad752683880c1bf8a55af0dc5f97357e3710d1ad9404310fecb31867d0c8e7d0a62feffdfbc26fefb943190f1

    • SSDEEP

      12288:XVX2hB3zhyaD44kjnXXLkdoOGYH6p9SsP:XoB39yn48XkGYH6n

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks