General

  • Target

    JaffaCakes118_8f765093477a3914c80e4abf3c01bfa4

  • Size

    406KB

  • Sample

    250105-gjhfkstqd1

  • MD5

    8f765093477a3914c80e4abf3c01bfa4

  • SHA1

    81908d089062bf15c67a9ea5a1714186a9c5a3bf

  • SHA256

    08087b6ef90a1ac7232fdafc4fd79a211c7f905ea618c36e672d576e1089cea6

  • SHA512

    5fd5107534d89131a3f01e1de896e10e8e7683aeb8473fa6357ef6d5be129c04ba0d5cc5d6cd0f31322ff2156a9c8659cbf9ebd301fd555a261b3ae6b0e34341

  • SSDEEP

    12288:qYaVjVue9ruo5wsmGioqddiE1uusOSRHU:qY+Aeruo5SG7E1uuGU

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_8f765093477a3914c80e4abf3c01bfa4

    • Size

      406KB

    • MD5

      8f765093477a3914c80e4abf3c01bfa4

    • SHA1

      81908d089062bf15c67a9ea5a1714186a9c5a3bf

    • SHA256

      08087b6ef90a1ac7232fdafc4fd79a211c7f905ea618c36e672d576e1089cea6

    • SHA512

      5fd5107534d89131a3f01e1de896e10e8e7683aeb8473fa6357ef6d5be129c04ba0d5cc5d6cd0f31322ff2156a9c8659cbf9ebd301fd555a261b3ae6b0e34341

    • SSDEEP

      12288:qYaVjVue9ruo5wsmGioqddiE1uusOSRHU:qY+Aeruo5SG7E1uuGU

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks