General

  • Target

    JaffaCakes118_c0f2b29fd765bc006cca50c07a29ca7b

  • Size

    337KB

  • Sample

    250109-gzz1ka1nb1

  • MD5

    c0f2b29fd765bc006cca50c07a29ca7b

  • SHA1

    7a1e4a9c4e653c06882a38153097f1b624cf4963

  • SHA256

    18125cc6cd5e88362125b405f2959a70a25267de73188c86c401564ba4418e9e

  • SHA512

    80c454f9882bab42a0f5fb7686dd1c39a10431174b9046ee5d1c40f3cb508933a16042cb59f4dd0f6eeb20fc6be5c01da515d5c87f9f3700541dab6f53954adb

  • SSDEEP

    6144:3Hx34z3eWAhyCmpfGwX3z5KahzUT9A8IU9Cm21d:3Ht4z3eW8ipLX31KahzUai9Cm

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_c0f2b29fd765bc006cca50c07a29ca7b

    • Size

      337KB

    • MD5

      c0f2b29fd765bc006cca50c07a29ca7b

    • SHA1

      7a1e4a9c4e653c06882a38153097f1b624cf4963

    • SHA256

      18125cc6cd5e88362125b405f2959a70a25267de73188c86c401564ba4418e9e

    • SHA512

      80c454f9882bab42a0f5fb7686dd1c39a10431174b9046ee5d1c40f3cb508933a16042cb59f4dd0f6eeb20fc6be5c01da515d5c87f9f3700541dab6f53954adb

    • SSDEEP

      6144:3Hx34z3eWAhyCmpfGwX3z5KahzUT9A8IU9Cm21d:3Ht4z3eW8ipLX31KahzUai9Cm

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks