General

  • Target

    JaffaCakes118_88649f9a7c8ece46ce0c7f0a20e2bafe

  • Size

    418KB

  • Sample

    250105-dyvsnszlfs

  • MD5

    88649f9a7c8ece46ce0c7f0a20e2bafe

  • SHA1

    98b5dbb26e1d1cadb73854806a65d6bc20d4f244

  • SHA256

    cb08c1a765482a557630fedcc246c7c957ca7748277999c799699b6c1b9f1bc2

  • SHA512

    01fdb806c514c0e66fade3fc0fa696a6838cfb41c5f70252d7222cab8ab4ac6780fba48bf141afa87f37435709156e2a9d8eb172cf4167c87fc61274d51bcd34

  • SSDEEP

    6144:ZcP/Hw+4h1qwar0MESciulCVWsUbdcCGadwOyjyeG0nNN7w9:Zyfg1qwarEScTlCVDAdcCGad6jPG0

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_88649f9a7c8ece46ce0c7f0a20e2bafe

    • Size

      418KB

    • MD5

      88649f9a7c8ece46ce0c7f0a20e2bafe

    • SHA1

      98b5dbb26e1d1cadb73854806a65d6bc20d4f244

    • SHA256

      cb08c1a765482a557630fedcc246c7c957ca7748277999c799699b6c1b9f1bc2

    • SHA512

      01fdb806c514c0e66fade3fc0fa696a6838cfb41c5f70252d7222cab8ab4ac6780fba48bf141afa87f37435709156e2a9d8eb172cf4167c87fc61274d51bcd34

    • SSDEEP

      6144:ZcP/Hw+4h1qwar0MESciulCVWsUbdcCGadwOyjyeG0nNN7w9:Zyfg1qwarEScTlCVDAdcCGad6jPG0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks