General

  • Target

    JaffaCakes118_13dd1fdf08d1bab7117249a1a9ff6d77

  • Size

    337KB

  • Sample

    250106-ha6bqa1mhj

  • MD5

    13dd1fdf08d1bab7117249a1a9ff6d77

  • SHA1

    a994083de044a7a6d8b8c2bd90daa8d4f1751828

  • SHA256

    b5d465363b48066dc11a8b8d3cd2d3fd956ed0bb9611cfcf392f7aed1c4ce2db

  • SHA512

    8a499be7a8d9ad1f58c46e3a2d430c3b003e2075352515917d115eaf127ddfae1e5cd593997828544d165e58f168bae2af09051d4d0ffd2c1a6fb961fe3b7787

  • SSDEEP

    6144:lXmHL5BP2jDDQ9NgR6EgDiHOCqWA675iFujZPpIADG8elx:l2HL7wDsNdsrqWdlpRxD8

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_13dd1fdf08d1bab7117249a1a9ff6d77

    • Size

      337KB

    • MD5

      13dd1fdf08d1bab7117249a1a9ff6d77

    • SHA1

      a994083de044a7a6d8b8c2bd90daa8d4f1751828

    • SHA256

      b5d465363b48066dc11a8b8d3cd2d3fd956ed0bb9611cfcf392f7aed1c4ce2db

    • SHA512

      8a499be7a8d9ad1f58c46e3a2d430c3b003e2075352515917d115eaf127ddfae1e5cd593997828544d165e58f168bae2af09051d4d0ffd2c1a6fb961fe3b7787

    • SSDEEP

      6144:lXmHL5BP2jDDQ9NgR6EgDiHOCqWA675iFujZPpIADG8elx:l2HL7wDsNdsrqWdlpRxD8

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks