General

  • Target

    JaffaCakes118_507e1c7d72413992431e9c317ffdca6d

  • Size

    369KB

  • Sample

    250107-gbsxcaylhl

  • MD5

    507e1c7d72413992431e9c317ffdca6d

  • SHA1

    78cfa38d7c395b921c359c675b75bbf27217fcce

  • SHA256

    27cc20c03452ed431a492dfe57f7f7689586de42467af930056cb01414798788

  • SHA512

    0f18b4bca2bdfe6b5544b7b1763685da8988e63d7c3df1f400fde4043c367277c576dfa9e04eaa4728979783e63d57176fdf0f37d834d3300250d601ac1e2980

  • SSDEEP

    6144:WpjqfFwKBOXiUOkg4JZN4dy4MaWrK5C5oPYGdm8qYMIeW:pNwKBmrJr2k4MaB5oGdm8qYMh

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_507e1c7d72413992431e9c317ffdca6d

    • Size

      369KB

    • MD5

      507e1c7d72413992431e9c317ffdca6d

    • SHA1

      78cfa38d7c395b921c359c675b75bbf27217fcce

    • SHA256

      27cc20c03452ed431a492dfe57f7f7689586de42467af930056cb01414798788

    • SHA512

      0f18b4bca2bdfe6b5544b7b1763685da8988e63d7c3df1f400fde4043c367277c576dfa9e04eaa4728979783e63d57176fdf0f37d834d3300250d601ac1e2980

    • SSDEEP

      6144:WpjqfFwKBOXiUOkg4JZN4dy4MaWrK5C5oPYGdm8qYMIeW:pNwKBmrJr2k4MaB5oGdm8qYMh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks