General

  • Target

    JaffaCakes118_75e25a598c246597f6a0e755ac0d405b

  • Size

    419KB

  • Sample

    250107-ygqgvaxngp

  • MD5

    75e25a598c246597f6a0e755ac0d405b

  • SHA1

    a7727dfb4e072cc2e891759ad91f7cd5ce4e9fbd

  • SHA256

    d32fbd7838bede71eb0affafdd0aef05e6d831b8fa32332b0f0cdb4f66545088

  • SHA512

    b7cbbbd153fce8c51c778236c1a95be742881736806f4706da48c833835c5071c614ff758d7125a070f99985e4b9cf5ddccb3f1a75a36c1c6e2a711808eb925c

  • SSDEEP

    12288:syd11NNx2Z3CYNsis2kACDxa/sg5uwGd36+JxDI29El8:sOxK3CLNw0+uz6+XDa8

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_75e25a598c246597f6a0e755ac0d405b

    • Size

      419KB

    • MD5

      75e25a598c246597f6a0e755ac0d405b

    • SHA1

      a7727dfb4e072cc2e891759ad91f7cd5ce4e9fbd

    • SHA256

      d32fbd7838bede71eb0affafdd0aef05e6d831b8fa32332b0f0cdb4f66545088

    • SHA512

      b7cbbbd153fce8c51c778236c1a95be742881736806f4706da48c833835c5071c614ff758d7125a070f99985e4b9cf5ddccb3f1a75a36c1c6e2a711808eb925c

    • SSDEEP

      12288:syd11NNx2Z3CYNsis2kACDxa/sg5uwGd36+JxDI29El8:sOxK3CLNw0+uz6+XDa8

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks