General

  • Target

    JaffaCakes118_c14afaf9f8938f10dbd177696b54fee5

  • Size

    417KB

  • Sample

    250109-hbdyvs1rg1

  • MD5

    c14afaf9f8938f10dbd177696b54fee5

  • SHA1

    a51c357b4888ab1bcfc79ec1e095a0079bd97c89

  • SHA256

    39a776f04b50a1bd49d49159f82e60acbdf4bc83cb34874a70580a7f6beef53b

  • SHA512

    d9a4ca92bf77cc2de0b8ffe7a95ac48e91039c6516cd7dcd54a2b68318de14eb2d28a062216da841c4a6ea29103a756df084c4d9816a4b78ff367556f21aef67

  • SSDEEP

    12288:iPf+uRO+dkBCY+58bCTAdxC8ly/xEGKW:iPf+uROH4Yjbq8ly/

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_c14afaf9f8938f10dbd177696b54fee5

    • Size

      417KB

    • MD5

      c14afaf9f8938f10dbd177696b54fee5

    • SHA1

      a51c357b4888ab1bcfc79ec1e095a0079bd97c89

    • SHA256

      39a776f04b50a1bd49d49159f82e60acbdf4bc83cb34874a70580a7f6beef53b

    • SHA512

      d9a4ca92bf77cc2de0b8ffe7a95ac48e91039c6516cd7dcd54a2b68318de14eb2d28a062216da841c4a6ea29103a756df084c4d9816a4b78ff367556f21aef67

    • SSDEEP

      12288:iPf+uRO+dkBCY+58bCTAdxC8ly/xEGKW:iPf+uROH4Yjbq8ly/

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks