General

  • Target

    JaffaCakes118_34e51540ec28e2d3fcc5fd28c3ef5547

  • Size

    369KB

  • Sample

    250106-xm1dkavjfy

  • MD5

    34e51540ec28e2d3fcc5fd28c3ef5547

  • SHA1

    4a6e985de322142944d04dd6fe04d180d4d5ee76

  • SHA256

    47a41d443d16fca4ca57d6fc31cae712b3efdf640db30a355bc875b5e99760c1

  • SHA512

    9d2bda25439dc753ef440c719a1d5b2ed0747247bcbd616e5cf55f864c4a5ac34008320ade8e140a6bfcdff7b87f055acf035274a3871cd3b0026a360d0e0361

  • SSDEEP

    6144:Qz57mMLpfYZ028YgpC2Fw9dWrF5ClTQ6GB+8qXKKy+5JFH:m57JfY18YgpCn9da5sGB+8qXKMJF

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_34e51540ec28e2d3fcc5fd28c3ef5547

    • Size

      369KB

    • MD5

      34e51540ec28e2d3fcc5fd28c3ef5547

    • SHA1

      4a6e985de322142944d04dd6fe04d180d4d5ee76

    • SHA256

      47a41d443d16fca4ca57d6fc31cae712b3efdf640db30a355bc875b5e99760c1

    • SHA512

      9d2bda25439dc753ef440c719a1d5b2ed0747247bcbd616e5cf55f864c4a5ac34008320ade8e140a6bfcdff7b87f055acf035274a3871cd3b0026a360d0e0361

    • SSDEEP

      6144:Qz57mMLpfYZ028YgpC2Fw9dWrF5ClTQ6GB+8qXKKy+5JFH:m57JfY18YgpCn9da5sGB+8qXKMJF

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks