General

  • Target

    JaffaCakes118_a14a831e34e92c47d386ae15ff10ab40

  • Size

    385KB

  • Sample

    250108-qfckla1lcs

  • MD5

    a14a831e34e92c47d386ae15ff10ab40

  • SHA1

    e66c0e72647183b913542a776826086f63a08efe

  • SHA256

    20f12e1bc7c394e23fb7274f23e287cf1632085ab2b0bb573979d8bb4dc50305

  • SHA512

    336c077fc3b81dbaa07ba68ff20d8a723df90c4ce117698df61edd8fe8fbaa25d5099128a0de0f13f11fa1d306017a28f74f8ac0b8b33a9ccfbbe34160527b22

  • SSDEEP

    6144:169XOrtp5BZL8IbygRsFDTIRK2AtTqNFvbmOAtNGMNkq7xYWe1:trdB52gRsxTB2AtONFjmntNaq7xbQ

Malware Config

Extracted

Family

redline

Botnet

part1

C2

45.9.20.107:46187

Attributes
  • auth_value

    60c75f1e2d31f6bac6dd7edad67d8615

Targets

    • Target

      JaffaCakes118_a14a831e34e92c47d386ae15ff10ab40

    • Size

      385KB

    • MD5

      a14a831e34e92c47d386ae15ff10ab40

    • SHA1

      e66c0e72647183b913542a776826086f63a08efe

    • SHA256

      20f12e1bc7c394e23fb7274f23e287cf1632085ab2b0bb573979d8bb4dc50305

    • SHA512

      336c077fc3b81dbaa07ba68ff20d8a723df90c4ce117698df61edd8fe8fbaa25d5099128a0de0f13f11fa1d306017a28f74f8ac0b8b33a9ccfbbe34160527b22

    • SSDEEP

      6144:169XOrtp5BZL8IbygRsFDTIRK2AtTqNFvbmOAtNGMNkq7xYWe1:trdB52gRsxTB2AtONFjmntNaq7xbQ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks