General

  • Target

    JaffaCakes118_bdc1e056885b68884ae50835bbe0f512

  • Size

    366KB

  • Sample

    250109-e86tcsymet

  • MD5

    bdc1e056885b68884ae50835bbe0f512

  • SHA1

    7faccc17b87b8b17ee05ed2d1ce95b70eae54a55

  • SHA256

    076666956446f0693c68ac681b8944e2786deaf3ea235347864030a407b091a2

  • SHA512

    59ce0a92d98a38bdd94221ff602caf26c525694c127cd35d4b005d618fb456f0d5b75859a5cd924a3558dc9ae46440bba05c99492d10bdbec0b13df3de1a7859

  • SSDEEP

    6144:DP5qdvvn9px3VAvRyhczNq9QC/Pw+cxfTNvLRS6SoKB:j5qlh3VAplzQ9QC/P8xfTNz9SoU

Malware Config

Extracted

Family

redline

Botnet

shop

C2

45.9.20.107:46187

Attributes
  • auth_value

    60c75f1e2d31f6bac6dd7edad67d8615

Targets

    • Target

      JaffaCakes118_bdc1e056885b68884ae50835bbe0f512

    • Size

      366KB

    • MD5

      bdc1e056885b68884ae50835bbe0f512

    • SHA1

      7faccc17b87b8b17ee05ed2d1ce95b70eae54a55

    • SHA256

      076666956446f0693c68ac681b8944e2786deaf3ea235347864030a407b091a2

    • SHA512

      59ce0a92d98a38bdd94221ff602caf26c525694c127cd35d4b005d618fb456f0d5b75859a5cd924a3558dc9ae46440bba05c99492d10bdbec0b13df3de1a7859

    • SSDEEP

      6144:DP5qdvvn9px3VAvRyhczNq9QC/Pw+cxfTNvLRS6SoKB:j5qlh3VAplzQ9QC/P8xfTNz9SoU

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks