General

  • Target

    JaffaCakes118_7889a58a0f9de0e0232fae49e29720be

  • Size

    337KB

  • Sample

    250107-zlxx6axqft

  • MD5

    7889a58a0f9de0e0232fae49e29720be

  • SHA1

    da552d952668eca3ffd54e5e17db42a981e60e06

  • SHA256

    e8cec127b74d80cb2ea26a2c9c0c04353386c2efb60145242e2a95d4cbad9ab2

  • SHA512

    920dd39793090bc5a05eda9ad4c9e8e0b36bb4ff33aa944f63b8fbee9b261c22c065e00e5ae56ffe97e366eee6cffb222c4ba4c746facc48e69dfa06e3332af1

  • SSDEEP

    6144:Ck7I0vqspxouYGuKL9AP5wrJCed4uWl1H2oQDr7IADG8elj:Xc0vVrou1PAPKrJCedZWlB29xD6

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_7889a58a0f9de0e0232fae49e29720be

    • Size

      337KB

    • MD5

      7889a58a0f9de0e0232fae49e29720be

    • SHA1

      da552d952668eca3ffd54e5e17db42a981e60e06

    • SHA256

      e8cec127b74d80cb2ea26a2c9c0c04353386c2efb60145242e2a95d4cbad9ab2

    • SHA512

      920dd39793090bc5a05eda9ad4c9e8e0b36bb4ff33aa944f63b8fbee9b261c22c065e00e5ae56ffe97e366eee6cffb222c4ba4c746facc48e69dfa06e3332af1

    • SSDEEP

      6144:Ck7I0vqspxouYGuKL9AP5wrJCed4uWl1H2oQDr7IADG8elj:Xc0vVrou1PAPKrJCedZWlB29xD6

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks