General

  • Target

    JaffaCakes118_43ee76c663395123d70b48b0dd1ccb58

  • Size

    369KB

  • Sample

    250107-a5xn3ayjhr

  • MD5

    43ee76c663395123d70b48b0dd1ccb58

  • SHA1

    a7afaf3ac9a90604fdda4513e274e63106878d23

  • SHA256

    d9d69651fc8bbd1f7aec6a37fb08acc4503c3a520c64200f670e95f3c0fda843

  • SHA512

    6ad4835dff05f653db430babd6ac380123b9e2b568e15a48d0b2afc3d7bc4eb14106b4bd2cc259fd0a88d3f42985ac89d969190207201641ad12c50ab4b2d998

  • SSDEEP

    6144:yUStz/DapsDpy6O70cLF6GXYAPz9WrA5CS5x7GvmQaDTMt8GVAn:yUwzrBDO70cLFtIqz9H5XGvmQaDT88GV

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_43ee76c663395123d70b48b0dd1ccb58

    • Size

      369KB

    • MD5

      43ee76c663395123d70b48b0dd1ccb58

    • SHA1

      a7afaf3ac9a90604fdda4513e274e63106878d23

    • SHA256

      d9d69651fc8bbd1f7aec6a37fb08acc4503c3a520c64200f670e95f3c0fda843

    • SHA512

      6ad4835dff05f653db430babd6ac380123b9e2b568e15a48d0b2afc3d7bc4eb14106b4bd2cc259fd0a88d3f42985ac89d969190207201641ad12c50ab4b2d998

    • SSDEEP

      6144:yUStz/DapsDpy6O70cLF6GXYAPz9WrA5CS5x7GvmQaDTMt8GVAn:yUwzrBDO70cLFtIqz9H5XGvmQaDT88GV

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks