General

  • Target

    JaffaCakes118_c9dd3f427f606fc45691f6b039ee1f64

  • Size

    406KB

  • Sample

    250109-q7kqaa1nfw

  • MD5

    c9dd3f427f606fc45691f6b039ee1f64

  • SHA1

    086fe49cf7668446a7cd4450c2bdbbed995a70bf

  • SHA256

    0c02527ff10846acc97cac63469ce62620d5f3c0145d6fcc318f14795af2f62a

  • SHA512

    41b1c7e959cf2c922aa58b2062b0d6f8c4ded00478040c5749c4ad36d031a2cc11803062147a22ed853a5d8e76c1a9a031d158030c5d305596b96ae020a34b34

  • SSDEEP

    12288:eyM9igD0nmh6xfyul/tTYpVVBd71NH/0m7mmZ:e0iWmh6Jnl/SpBNH/0

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_c9dd3f427f606fc45691f6b039ee1f64

    • Size

      406KB

    • MD5

      c9dd3f427f606fc45691f6b039ee1f64

    • SHA1

      086fe49cf7668446a7cd4450c2bdbbed995a70bf

    • SHA256

      0c02527ff10846acc97cac63469ce62620d5f3c0145d6fcc318f14795af2f62a

    • SHA512

      41b1c7e959cf2c922aa58b2062b0d6f8c4ded00478040c5749c4ad36d031a2cc11803062147a22ed853a5d8e76c1a9a031d158030c5d305596b96ae020a34b34

    • SSDEEP

      12288:eyM9igD0nmh6xfyul/tTYpVVBd71NH/0m7mmZ:e0iWmh6Jnl/SpBNH/0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks