General

  • Target

    JaffaCakes118_0e650ab9c825abce879b0f2db084eb38

  • Size

    337KB

  • Sample

    250106-e273vawlgs

  • MD5

    0e650ab9c825abce879b0f2db084eb38

  • SHA1

    84e57fd2dba5467f4bc2d8f29ea2f177fd9428dc

  • SHA256

    a04401541f4ea1d311699241b8bd03c641da0d87dfbb4fefb04903b0eba03ecb

  • SHA512

    ad8a569e9e93c3831a95bb0adcac9f4bce9087e6256471a70a16a65e0a9757e7a1287aa8ded94d2b50a4976aae1c9f129539d396fa7941138396cdf20e39b54f

  • SSDEEP

    6144:4HGHL5BgiSio083GLv8jmS+YFAgJX+bIADG8elP:4mHL7giFod2T8jm10X+bxDy

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_0e650ab9c825abce879b0f2db084eb38

    • Size

      337KB

    • MD5

      0e650ab9c825abce879b0f2db084eb38

    • SHA1

      84e57fd2dba5467f4bc2d8f29ea2f177fd9428dc

    • SHA256

      a04401541f4ea1d311699241b8bd03c641da0d87dfbb4fefb04903b0eba03ecb

    • SHA512

      ad8a569e9e93c3831a95bb0adcac9f4bce9087e6256471a70a16a65e0a9757e7a1287aa8ded94d2b50a4976aae1c9f129539d396fa7941138396cdf20e39b54f

    • SSDEEP

      6144:4HGHL5BgiSio083GLv8jmS+YFAgJX+bIADG8elP:4mHL7giFod2T8jm10X+bxDy

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks