General

  • Target

    JaffaCakes118_7c3036ffb6d2bee4370a9937d735de29

  • Size

    336KB

  • Sample

    250104-14epzazmgt

  • MD5

    7c3036ffb6d2bee4370a9937d735de29

  • SHA1

    b065bc27d62fbec79268209fcdd99c70b2832ba3

  • SHA256

    57144f449f3e48694fa08afadfea4e0688eedf0b5e2e3c85b5bc124cc265bfca

  • SHA512

    7a00ecc6befc32eda619db21d73c2472ce685790c111f1ebc46fd222faa7da41648528541f59a703a53a7a5ea9adc0f1fbb25ed57945f07d2cb18a887d147b9c

  • SSDEEP

    6144:MBsgPV8+HEA2HRmND3j1UClPVHDCVeHUw9A8SJxd3MTyiHv:KKoKcNDz1UCtHDCVeHUV9xd3jiH

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_7c3036ffb6d2bee4370a9937d735de29

    • Size

      336KB

    • MD5

      7c3036ffb6d2bee4370a9937d735de29

    • SHA1

      b065bc27d62fbec79268209fcdd99c70b2832ba3

    • SHA256

      57144f449f3e48694fa08afadfea4e0688eedf0b5e2e3c85b5bc124cc265bfca

    • SHA512

      7a00ecc6befc32eda619db21d73c2472ce685790c111f1ebc46fd222faa7da41648528541f59a703a53a7a5ea9adc0f1fbb25ed57945f07d2cb18a887d147b9c

    • SSDEEP

      6144:MBsgPV8+HEA2HRmND3j1UClPVHDCVeHUw9A8SJxd3MTyiHv:KKoKcNDz1UCtHDCVeHUV9xd3jiH

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks