General

  • Target

    JaffaCakes118_4195c7ba738a6cb07a944819874b6ae8

  • Size

    417KB

  • Sample

    250101-bdlcdsylgv

  • MD5

    4195c7ba738a6cb07a944819874b6ae8

  • SHA1

    4c0941a81a7672639797c755bf9595701b40f9df

  • SHA256

    99be762e300ce54ae6afed2893d0906104a1765cca7bbbb2b9c20dcc99641819

  • SHA512

    dd9aaa975574853958039b23b1338d1d527f30ec927bb42b15739acc463172d2df5e7c8ebe277ac937aea5934eb05f6763e99dfe1d386ca8ba69d64f4b21be81

  • SSDEEP

    12288:aN3h2iDhFhws8sjd8wvQ3nDGdji94VWhiG9LC:aNx2+hF/8sB8X3N94VW

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_4195c7ba738a6cb07a944819874b6ae8

    • Size

      417KB

    • MD5

      4195c7ba738a6cb07a944819874b6ae8

    • SHA1

      4c0941a81a7672639797c755bf9595701b40f9df

    • SHA256

      99be762e300ce54ae6afed2893d0906104a1765cca7bbbb2b9c20dcc99641819

    • SHA512

      dd9aaa975574853958039b23b1338d1d527f30ec927bb42b15739acc463172d2df5e7c8ebe277ac937aea5934eb05f6763e99dfe1d386ca8ba69d64f4b21be81

    • SSDEEP

      12288:aN3h2iDhFhws8sjd8wvQ3nDGdji94VWhiG9LC:aNx2+hF/8sB8X3N94VW

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks