General

  • Target

    JaffaCakes118_5e9446daea4922400f1e3883d8110f7a

  • Size

    370KB

  • Sample

    250101-wb8p5ayjhl

  • MD5

    5e9446daea4922400f1e3883d8110f7a

  • SHA1

    ed087f4693fff220bec11dc7ab1ce39a5cfa23f3

  • SHA256

    a139d2cb2fba2e0377cab79f9acd7115f8c1c3afb4570bbc5f4b96a8e619a6bb

  • SHA512

    04c9defe61981c5d4a5c495de2820bd71fb38436d8a4b51ca0b877cee1f129bd567f2714c60ca21a456ea54fdf8b28de3e2baf1d8ea1a7262ffd3a86bf73f474

  • SSDEEP

    6144:3Dh9u79K/U9InuvyQPGNjxiSiOxqdHqN5ecZ/OQetwI4BAviITnQB:7uhK1e+xSOxq4fecZ/OFwI4BAqeQB

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_5e9446daea4922400f1e3883d8110f7a

    • Size

      370KB

    • MD5

      5e9446daea4922400f1e3883d8110f7a

    • SHA1

      ed087f4693fff220bec11dc7ab1ce39a5cfa23f3

    • SHA256

      a139d2cb2fba2e0377cab79f9acd7115f8c1c3afb4570bbc5f4b96a8e619a6bb

    • SHA512

      04c9defe61981c5d4a5c495de2820bd71fb38436d8a4b51ca0b877cee1f129bd567f2714c60ca21a456ea54fdf8b28de3e2baf1d8ea1a7262ffd3a86bf73f474

    • SSDEEP

      6144:3Dh9u79K/U9InuvyQPGNjxiSiOxqdHqN5ecZ/OQetwI4BAviITnQB:7uhK1e+xSOxq4fecZ/OFwI4BAqeQB

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks