General

  • Target

    JaffaCakes118_277a1fa0961fa8ce5a52cb411d151703

  • Size

    336KB

  • Sample

    250106-q9dprazraq

  • MD5

    277a1fa0961fa8ce5a52cb411d151703

  • SHA1

    3b7d6bd3442f2faa532255b0d5e2329f4be35880

  • SHA256

    8bea286401df8eeaf93b4af9be64eb59e9fab3f1e8abd1d5e92517011235ada2

  • SHA512

    f59635e95d06b669e22774426235e176d46723e2cf124ca8ae08f1f6fffc0fcf267ceec81bb56b43463e27e9e44501bc5540bbe32314a6634fdcb04cc0878354

  • SSDEEP

    6144:XaVLvhLqiS7I21eD4pGj8QaRAiMOJOqUq9A8vRhVO0gIuL:XaVLvRqi1F4IkRxMOJOqUf0hVOWE

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_277a1fa0961fa8ce5a52cb411d151703

    • Size

      336KB

    • MD5

      277a1fa0961fa8ce5a52cb411d151703

    • SHA1

      3b7d6bd3442f2faa532255b0d5e2329f4be35880

    • SHA256

      8bea286401df8eeaf93b4af9be64eb59e9fab3f1e8abd1d5e92517011235ada2

    • SHA512

      f59635e95d06b669e22774426235e176d46723e2cf124ca8ae08f1f6fffc0fcf267ceec81bb56b43463e27e9e44501bc5540bbe32314a6634fdcb04cc0878354

    • SSDEEP

      6144:XaVLvhLqiS7I21eD4pGj8QaRAiMOJOqUq9A8vRhVO0gIuL:XaVLvRqi1F4IkRxMOJOqUf0hVOWE

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks