General

  • Target

    JaffaCakes118_a2b17a4e8a1fca7373e2947642a2ac6d

  • Size

    337KB

  • Sample

    250105-n8ejjswjhj

  • MD5

    a2b17a4e8a1fca7373e2947642a2ac6d

  • SHA1

    91a08d5e4b1ee5be6f9f4dfc95b3a9429c0a9b45

  • SHA256

    dfeda02a5618b344a9896e0d026b43f80af5795a8d29198a837f987c460eee31

  • SHA512

    4a257a784df0fadbccd1d76322af8cb2b94e0cf3304e7e8d1e7126f456d5a152a2a5fe756d045cb6ede918dc0a56c784447583afa4952b11c2ab403b6113522d

  • SSDEEP

    6144:7ytyQ8EaL03Cg8gvr25mmYvDody0O3yOUts5yWzdELNK0:7yEEaL03kMq5mmYro40O3yOUtdWzdz

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_a2b17a4e8a1fca7373e2947642a2ac6d

    • Size

      337KB

    • MD5

      a2b17a4e8a1fca7373e2947642a2ac6d

    • SHA1

      91a08d5e4b1ee5be6f9f4dfc95b3a9429c0a9b45

    • SHA256

      dfeda02a5618b344a9896e0d026b43f80af5795a8d29198a837f987c460eee31

    • SHA512

      4a257a784df0fadbccd1d76322af8cb2b94e0cf3304e7e8d1e7126f456d5a152a2a5fe756d045cb6ede918dc0a56c784447583afa4952b11c2ab403b6113522d

    • SSDEEP

      6144:7ytyQ8EaL03Cg8gvr25mmYvDody0O3yOUts5yWzdELNK0:7yEEaL03kMq5mmYro40O3yOUtdWzdz

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks