General

  • Target

    JaffaCakes118_8c5b7419a8d955f03f6a86c013171ca8

  • Size

    336KB

  • Sample

    250108-fh5n2sxmap

  • MD5

    8c5b7419a8d955f03f6a86c013171ca8

  • SHA1

    6fcd24450501961f751d38a4f2e429fd7c512f0b

  • SHA256

    823d3c1a9f0d0c7c63c2889c2d46d485a33fff768abce0c5f060801c43090f97

  • SHA512

    ad7815205dfdbdf4db616507d133154e3a65df1349cbecdc47eadc7c6661efb27e6c67f7f3f3da98b120e62b1d2da063d31136daff2be66b7705fca97f040f25

  • SSDEEP

    6144:60Ati69arAZ0N5p8NY4qcOo78IDT0liSxhWJVXZIoqX7tNfVXVHQLIiu8cQ:60b69mAcP1UAIXucZIowZGEX8cQ

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_8c5b7419a8d955f03f6a86c013171ca8

    • Size

      336KB

    • MD5

      8c5b7419a8d955f03f6a86c013171ca8

    • SHA1

      6fcd24450501961f751d38a4f2e429fd7c512f0b

    • SHA256

      823d3c1a9f0d0c7c63c2889c2d46d485a33fff768abce0c5f060801c43090f97

    • SHA512

      ad7815205dfdbdf4db616507d133154e3a65df1349cbecdc47eadc7c6661efb27e6c67f7f3f3da98b120e62b1d2da063d31136daff2be66b7705fca97f040f25

    • SSDEEP

      6144:60Ati69arAZ0N5p8NY4qcOo78IDT0liSxhWJVXZIoqX7tNfVXVHQLIiu8cQ:60b69mAcP1UAIXucZIowZGEX8cQ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks