General

  • Target

    JaffaCakes118_517a9a6270c0b8dcde71dbd77f3b9f68

  • Size

    366KB

  • Sample

    250101-mgl9msvlgr

  • MD5

    517a9a6270c0b8dcde71dbd77f3b9f68

  • SHA1

    70872b6790dc0d937f622b0c160e4067440a98f9

  • SHA256

    097cdcb61791ff377817655d9b3796e81b9527fb2cf28a8cb18a870fbdb9e209

  • SHA512

    7757c8777e1e0bfa4bd922f542d7b4b4d636cf7b7643738f6fd46f86a94140a5ed5e6395e603aca29eefad074e2b3f9488ddd9e6a6b4eb7eb097c1d4e274776d

  • SSDEEP

    6144:Wo1Ja1/djGKMlFkkP4zHDPBDiX2Mo0NbtQI/WJVNGAO8zdv15MD:Tad5cFkTXPBD6FtQI/WpGAOulED

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_517a9a6270c0b8dcde71dbd77f3b9f68

    • Size

      366KB

    • MD5

      517a9a6270c0b8dcde71dbd77f3b9f68

    • SHA1

      70872b6790dc0d937f622b0c160e4067440a98f9

    • SHA256

      097cdcb61791ff377817655d9b3796e81b9527fb2cf28a8cb18a870fbdb9e209

    • SHA512

      7757c8777e1e0bfa4bd922f542d7b4b4d636cf7b7643738f6fd46f86a94140a5ed5e6395e603aca29eefad074e2b3f9488ddd9e6a6b4eb7eb097c1d4e274776d

    • SSDEEP

      6144:Wo1Ja1/djGKMlFkkP4zHDPBDiX2Mo0NbtQI/WJVNGAO8zdv15MD:Tad5cFkTXPBD6FtQI/WpGAOulED

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks