General

  • Target

    JaffaCakes118_727f3b8961e436fa68f6e0a9d9703e87

  • Size

    336KB

  • Sample

    250103-2mcdysxlfx

  • MD5

    727f3b8961e436fa68f6e0a9d9703e87

  • SHA1

    3ddd5ae8a0dd11b5960cb85513d049345c30ea68

  • SHA256

    c83b5f64352d87a5e5a48dbd037bf316b0445c57008e553f167d9aec61e8bafa

  • SHA512

    12f94ee74826bf1573dd6d45bbd8d3364a6eddc4436206fc3a7a94612300dff6d58c9d44d0b57edf840c1af4f0eecda1f3000276e983ac778cd94b798578195c

  • SSDEEP

    6144:gMB2UH3xxvXTe7aL1j+oVHUJ9A8u6lKwOg2/EA:jX7/6mj+oVHUg6lKw1A

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_727f3b8961e436fa68f6e0a9d9703e87

    • Size

      336KB

    • MD5

      727f3b8961e436fa68f6e0a9d9703e87

    • SHA1

      3ddd5ae8a0dd11b5960cb85513d049345c30ea68

    • SHA256

      c83b5f64352d87a5e5a48dbd037bf316b0445c57008e553f167d9aec61e8bafa

    • SHA512

      12f94ee74826bf1573dd6d45bbd8d3364a6eddc4436206fc3a7a94612300dff6d58c9d44d0b57edf840c1af4f0eecda1f3000276e983ac778cd94b798578195c

    • SSDEEP

      6144:gMB2UH3xxvXTe7aL1j+oVHUJ9A8u6lKwOg2/EA:jX7/6mj+oVHUg6lKw1A

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks