General

  • Target

    JaffaCakes118_7c0a4453fcc76ed9a621cbcd35529970

  • Size

    417KB

  • Sample

    250104-1wzeeazjdy

  • MD5

    7c0a4453fcc76ed9a621cbcd35529970

  • SHA1

    7c9e0b1ee45bec9cbb0e56a452efe5afc8156a3d

  • SHA256

    c7a4ac68b75d2638dd62919fbe149f30edd2b662bc65ca9c8b822c5ffc84125f

  • SHA512

    43dc632cf303bf003b8f23282f7ef7254c66140d74801805035c130fc00f4b2c1b65dc309b21b3001c960be59aa565c4dbdcf14e1acd9124baf17e3c1e4171fe

  • SSDEEP

    12288:GTbdZlpw06eyWT4j2rhUA2GGgYHdmXzIgzaeGD:Gv/U0xrhUMG2zIgz

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_7c0a4453fcc76ed9a621cbcd35529970

    • Size

      417KB

    • MD5

      7c0a4453fcc76ed9a621cbcd35529970

    • SHA1

      7c9e0b1ee45bec9cbb0e56a452efe5afc8156a3d

    • SHA256

      c7a4ac68b75d2638dd62919fbe149f30edd2b662bc65ca9c8b822c5ffc84125f

    • SHA512

      43dc632cf303bf003b8f23282f7ef7254c66140d74801805035c130fc00f4b2c1b65dc309b21b3001c960be59aa565c4dbdcf14e1acd9124baf17e3c1e4171fe

    • SSDEEP

      12288:GTbdZlpw06eyWT4j2rhUA2GGgYHdmXzIgzaeGD:Gv/U0xrhUMG2zIgz

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks