General

  • Target

    JaffaCakes118_71680622bc8e95f9a3537672bc3295ef

  • Size

    407KB

  • Sample

    250103-1923fswpcz

  • MD5

    71680622bc8e95f9a3537672bc3295ef

  • SHA1

    2c8da3160a34a834708a9c0193dee4d983458515

  • SHA256

    91872ed400a56e17b653325709dc0ca75a93b45f2343e049257cfdee24be63d5

  • SHA512

    fc95196ca284e262d6559643db696fccbf58d54d93a93a3aa5347d201ec8097a51d11d7f8aff3eb712ac483bb74abdd65f5d9a9b6a80df3a3b0945d95915cdf6

  • SSDEEP

    6144:gpDaX2ZQwfS9VAgQHjqBY3ww4rS6IEhs2/FdzyTx08o+Z+yZSEI2C:gu2IEDqB9w4+6IE68dzyd08J+cSEi

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_71680622bc8e95f9a3537672bc3295ef

    • Size

      407KB

    • MD5

      71680622bc8e95f9a3537672bc3295ef

    • SHA1

      2c8da3160a34a834708a9c0193dee4d983458515

    • SHA256

      91872ed400a56e17b653325709dc0ca75a93b45f2343e049257cfdee24be63d5

    • SHA512

      fc95196ca284e262d6559643db696fccbf58d54d93a93a3aa5347d201ec8097a51d11d7f8aff3eb712ac483bb74abdd65f5d9a9b6a80df3a3b0945d95915cdf6

    • SSDEEP

      6144:gpDaX2ZQwfS9VAgQHjqBY3ww4rS6IEhs2/FdzyTx08o+Z+yZSEI2C:gu2IEDqB9w4+6IE68dzyd08J+cSEi

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks