General

  • Target

    JaffaCakes118_84138f32c533f94e479f6840fb705c5a

  • Size

    406KB

  • Sample

    250105-cdtjfaxmdz

  • MD5

    84138f32c533f94e479f6840fb705c5a

  • SHA1

    932334f1e7f04aaf54f8edc191f19e5c448ea294

  • SHA256

    f41de80f763752f7ee152bef69f2b15e7582550b108f6b3a0dde4f4078231937

  • SHA512

    dc6507bfd0eb7398ff4500c78c983c676b5cda9bbd4dafe3c775a1983c1d5357306348b4d72afb8f5302a775caf7a1690dc8b9865726c1ed5c878569f6358fc3

  • SSDEEP

    12288:NUXj472952qk98oJWRYdwOyYAP4jWV61:NA47Q5XkNJ1yYAPC1

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_84138f32c533f94e479f6840fb705c5a

    • Size

      406KB

    • MD5

      84138f32c533f94e479f6840fb705c5a

    • SHA1

      932334f1e7f04aaf54f8edc191f19e5c448ea294

    • SHA256

      f41de80f763752f7ee152bef69f2b15e7582550b108f6b3a0dde4f4078231937

    • SHA512

      dc6507bfd0eb7398ff4500c78c983c676b5cda9bbd4dafe3c775a1983c1d5357306348b4d72afb8f5302a775caf7a1690dc8b9865726c1ed5c878569f6358fc3

    • SSDEEP

      12288:NUXj472952qk98oJWRYdwOyYAP4jWV61:NA47Q5XkNJ1yYAPC1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks