General

  • Target

    JaffaCakes118_baf367bf5b5c5958ba3c89223361e892

  • Size

    406KB

  • Sample

    250105-ysa7aswqgm

  • MD5

    baf367bf5b5c5958ba3c89223361e892

  • SHA1

    743b4954c6f9d366ac494890e2f224c3f92e87cd

  • SHA256

    bff2d0358b6b5cce52c454ba58b74a5791ee5cb1980adc24ca1a6e540c2b85f9

  • SHA512

    2cad5e30cd676903f9a08cb40e745b75feb93c37d8b14ea945fe5d91821b59cf65c0fa87726a3b62b67aaa37dd3ca986d8517c1cd6179407491c2f54bb343cc9

  • SSDEEP

    12288:MJGT1fRo0AoELtG+BmjwHr/CQIadQXxe1iE99aWw:MJGZfRoj/Q+Bm0DCZxe1iED

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_baf367bf5b5c5958ba3c89223361e892

    • Size

      406KB

    • MD5

      baf367bf5b5c5958ba3c89223361e892

    • SHA1

      743b4954c6f9d366ac494890e2f224c3f92e87cd

    • SHA256

      bff2d0358b6b5cce52c454ba58b74a5791ee5cb1980adc24ca1a6e540c2b85f9

    • SHA512

      2cad5e30cd676903f9a08cb40e745b75feb93c37d8b14ea945fe5d91821b59cf65c0fa87726a3b62b67aaa37dd3ca986d8517c1cd6179407491c2f54bb343cc9

    • SSDEEP

      12288:MJGT1fRo0AoELtG+BmjwHr/CQIadQXxe1iE99aWw:MJGZfRoj/Q+Bm0DCZxe1iED

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks