General

  • Target

    JaffaCakes118_1f2b7ec4709730896fbf557d3157baaa

  • Size

    406KB

  • Sample

    241231-qxt6zavnfq

  • MD5

    1f2b7ec4709730896fbf557d3157baaa

  • SHA1

    b56be4441950893403b7e1a6b7c8972ef6b3ec1e

  • SHA256

    4bed0a8c5f5760ede547a9c559f14787dd738e0c70ecc125b2300ce111005436

  • SHA512

    855ad7be4e87d51f421a3537dc04d283e2be2d6f4cb8072a19f855fc772b4c26d095839b366c21dad1276131355d0554dfbb525fbbb29b2055c5df34d9a24789

  • SSDEEP

    12288:S1IE3GmvRelQhUW6gLLAn76dFirI96ZqSGsn:S1F2mZHhUW6UAzrI96r

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_1f2b7ec4709730896fbf557d3157baaa

    • Size

      406KB

    • MD5

      1f2b7ec4709730896fbf557d3157baaa

    • SHA1

      b56be4441950893403b7e1a6b7c8972ef6b3ec1e

    • SHA256

      4bed0a8c5f5760ede547a9c559f14787dd738e0c70ecc125b2300ce111005436

    • SHA512

      855ad7be4e87d51f421a3537dc04d283e2be2d6f4cb8072a19f855fc772b4c26d095839b366c21dad1276131355d0554dfbb525fbbb29b2055c5df34d9a24789

    • SSDEEP

      12288:S1IE3GmvRelQhUW6gLLAn76dFirI96ZqSGsn:S1F2mZHhUW6UAzrI96r

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks