General

  • Target

    JaffaCakes118_bb09bd86645d822949e6cb9258166239

  • Size

    406KB

  • Sample

    250105-ytek4svkcv

  • MD5

    bb09bd86645d822949e6cb9258166239

  • SHA1

    fde99409d3a2366eb8a47cceffd7bc168bc3eaad

  • SHA256

    42786bdf6517f283eb4711ec3ace800722b95674b106384d50459cfd346726c3

  • SHA512

    26d780189ef6cefc34693bc7f974c8a9da311b7daa833a493c7749bccd581d255b27915a9d820aee3931970b5b35dabfecea4550e11b0ec44dd528d4ea9ebdb5

  • SSDEEP

    12288:Iv5TYLZ8B5/kPp3GZ6lGCfvvIdRClI7BRAmd87Z:IedQ5cO6FfhlI7BA7Z

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_bb09bd86645d822949e6cb9258166239

    • Size

      406KB

    • MD5

      bb09bd86645d822949e6cb9258166239

    • SHA1

      fde99409d3a2366eb8a47cceffd7bc168bc3eaad

    • SHA256

      42786bdf6517f283eb4711ec3ace800722b95674b106384d50459cfd346726c3

    • SHA512

      26d780189ef6cefc34693bc7f974c8a9da311b7daa833a493c7749bccd581d255b27915a9d820aee3931970b5b35dabfecea4550e11b0ec44dd528d4ea9ebdb5

    • SSDEEP

      12288:Iv5TYLZ8B5/kPp3GZ6lGCfvvIdRClI7BRAmd87Z:IedQ5cO6FfhlI7BA7Z

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks