General

  • Target

    JaffaCakes118_2c9ea9cb0c85d61fb9fa6005e7ab6f80

  • Size

    369KB

  • Sample

    241231-wen5wstqhp

  • MD5

    2c9ea9cb0c85d61fb9fa6005e7ab6f80

  • SHA1

    509649cf4e42e6341ebf44f8e1e7e88c09d7abae

  • SHA256

    a0f0b8352d3c763435a02a883ddff0c11bc4b1babbf20380c3d32d8a9532ec2f

  • SHA512

    546a4138433f219905af58554034cc6cdc343c33edb8136ab9486e657403ac4026c76245dcfc7016f02a3e77c808020bb79e15a6b49b30eea1ecb2e8fd7cb9c0

  • SSDEEP

    6144:99mJBUPPs4PgXxgIdvQWr65CZim2GlPrHdsec:9YJesQgBgYvQJ5pGlPrHdsF

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_2c9ea9cb0c85d61fb9fa6005e7ab6f80

    • Size

      369KB

    • MD5

      2c9ea9cb0c85d61fb9fa6005e7ab6f80

    • SHA1

      509649cf4e42e6341ebf44f8e1e7e88c09d7abae

    • SHA256

      a0f0b8352d3c763435a02a883ddff0c11bc4b1babbf20380c3d32d8a9532ec2f

    • SHA512

      546a4138433f219905af58554034cc6cdc343c33edb8136ab9486e657403ac4026c76245dcfc7016f02a3e77c808020bb79e15a6b49b30eea1ecb2e8fd7cb9c0

    • SSDEEP

      6144:99mJBUPPs4PgXxgIdvQWr65CZim2GlPrHdsec:9YJesQgBgYvQJ5pGlPrHdsF

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks