General

  • Target

    JaffaCakes118_6bca2d3e34e4d45f330fbfa716ded7f2

  • Size

    370KB

  • Sample

    250103-lv46yaxpb1

  • MD5

    6bca2d3e34e4d45f330fbfa716ded7f2

  • SHA1

    c0b61eaadcf661148d36e9275684a475c058ea4d

  • SHA256

    a8cd112c9b691fe4dd0ce974b4c0c611cec4f13bdf2073eec9764df7b2746f59

  • SHA512

    3eb7dbc9bf9ba2ef364ce2d5b58c70b7228cc59702527c2f6bcf939a4ff6ebb85b5e7848ccb162552a79718af22beffc8b18b3230dfc9205a9d70b56a0cb0e61

  • SSDEEP

    6144:DCVAZVpSHyVYh9AORUGErBIaNxSMd/u2Ol44Q8ayt5KNo:B0HJnM3SMd/u/44Q8FaNo

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_6bca2d3e34e4d45f330fbfa716ded7f2

    • Size

      370KB

    • MD5

      6bca2d3e34e4d45f330fbfa716ded7f2

    • SHA1

      c0b61eaadcf661148d36e9275684a475c058ea4d

    • SHA256

      a8cd112c9b691fe4dd0ce974b4c0c611cec4f13bdf2073eec9764df7b2746f59

    • SHA512

      3eb7dbc9bf9ba2ef364ce2d5b58c70b7228cc59702527c2f6bcf939a4ff6ebb85b5e7848ccb162552a79718af22beffc8b18b3230dfc9205a9d70b56a0cb0e61

    • SSDEEP

      6144:DCVAZVpSHyVYh9AORUGErBIaNxSMd/u2Ol44Q8ayt5KNo:B0HJnM3SMd/u/44Q8FaNo

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks