General

  • Target

    JaffaCakes118_44b4197df5de6043c2b10db22a2a9d30

  • Size

    369KB

  • Sample

    250107-bfyeqswqfx

  • MD5

    44b4197df5de6043c2b10db22a2a9d30

  • SHA1

    5b3d2ec2ff2b12e9ce309873b39b15df0f69c3b6

  • SHA256

    882acbecf7a9c29d81e098db6910a538f175a9f81a484e6bcee0023088ca2717

  • SHA512

    622a0e41e713a42e9b836db223b37c1c1e8e6f54e93d985865f7c2fa85e314ada8b870376e20c266a3dda7e1952c911d9fbb17725b7dea2a01e35e4ecef50fce

  • SSDEEP

    6144:wtkym9ql+YRNeo6Av6vpdyKWrD5Cfi02GfukbtsUtNl:iTm9y+iUA4yKE5JGfukbtsyN

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_44b4197df5de6043c2b10db22a2a9d30

    • Size

      369KB

    • MD5

      44b4197df5de6043c2b10db22a2a9d30

    • SHA1

      5b3d2ec2ff2b12e9ce309873b39b15df0f69c3b6

    • SHA256

      882acbecf7a9c29d81e098db6910a538f175a9f81a484e6bcee0023088ca2717

    • SHA512

      622a0e41e713a42e9b836db223b37c1c1e8e6f54e93d985865f7c2fa85e314ada8b870376e20c266a3dda7e1952c911d9fbb17725b7dea2a01e35e4ecef50fce

    • SSDEEP

      6144:wtkym9ql+YRNeo6Av6vpdyKWrD5Cfi02GfukbtsUtNl:iTm9y+iUA4yKE5JGfukbtsyN

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks