General

  • Target

    JaffaCakes118_910f5acc0001c3f86e54812d83b9dd1b

  • Size

    337KB

  • Sample

    250108-hhcdls1kgn

  • MD5

    910f5acc0001c3f86e54812d83b9dd1b

  • SHA1

    68ecc5c4140119744e7d43a417e6fae36651e984

  • SHA256

    f42c72fb8c2a92d2fa7ef5916b53e453f456c3580684ab2bc8ba2bdc48d18d7d

  • SHA512

    d0b6163c21fabdee902e118726ff9b35cdcf0427967045a02c398f9eef40fcebb40717131e33416efbebe4d14deb2ee6f71c23193f8ab8ba4931bb0d31ada8ac

  • SSDEEP

    6144:DI6QtkqUWmhQNxvDxG7gNqQSdVtIADG8elf:DxQtkqZd3Nb8VtxDe

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_910f5acc0001c3f86e54812d83b9dd1b

    • Size

      337KB

    • MD5

      910f5acc0001c3f86e54812d83b9dd1b

    • SHA1

      68ecc5c4140119744e7d43a417e6fae36651e984

    • SHA256

      f42c72fb8c2a92d2fa7ef5916b53e453f456c3580684ab2bc8ba2bdc48d18d7d

    • SHA512

      d0b6163c21fabdee902e118726ff9b35cdcf0427967045a02c398f9eef40fcebb40717131e33416efbebe4d14deb2ee6f71c23193f8ab8ba4931bb0d31ada8ac

    • SSDEEP

      6144:DI6QtkqUWmhQNxvDxG7gNqQSdVtIADG8elf:DxQtkqZd3Nb8VtxDe

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks