General

  • Target

    JaffaCakes118_171c94ac2297a47e836f3665aeacff8d

  • Size

    366KB

  • Sample

    241231-nacmasxnez

  • MD5

    171c94ac2297a47e836f3665aeacff8d

  • SHA1

    6d40df340304405a1c79a192b41a35b7417247f4

  • SHA256

    eff20fcad43e1285078db09eda1eadab4df557e79a0e58ebeff959c79455ff0d

  • SHA512

    c4a5715dc204423d23a224e740028d4f0439b0c076b6c5ad7bc3b86fde8b77115b7ce43aebd3ace8751b4ac1322fc4bfe3ccd61f96df79de1c89dd4c525be4f2

  • SSDEEP

    6144:wijnTUAx2iswvh4hQwbq+Z+CKOF3N+0l1D2qX7tNfVXVHQLIiu8cfo0/pWm:wiLTUAx9hhC+C1++2wZGEX8cA0/Mm

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_171c94ac2297a47e836f3665aeacff8d

    • Size

      366KB

    • MD5

      171c94ac2297a47e836f3665aeacff8d

    • SHA1

      6d40df340304405a1c79a192b41a35b7417247f4

    • SHA256

      eff20fcad43e1285078db09eda1eadab4df557e79a0e58ebeff959c79455ff0d

    • SHA512

      c4a5715dc204423d23a224e740028d4f0439b0c076b6c5ad7bc3b86fde8b77115b7ce43aebd3ace8751b4ac1322fc4bfe3ccd61f96df79de1c89dd4c525be4f2

    • SSDEEP

      6144:wijnTUAx2iswvh4hQwbq+Z+CKOF3N+0l1D2qX7tNfVXVHQLIiu8cfo0/pWm:wiLTUAx9hhC+C1++2wZGEX8cA0/Mm

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks