General

  • Target

    JaffaCakes118_d1b20ece149b4f3f35a578ffa9f77167

  • Size

    406KB

  • Sample

    250109-zazydasmcp

  • MD5

    d1b20ece149b4f3f35a578ffa9f77167

  • SHA1

    4362e61ba3d3304779c762d5a41bb0547407cf5b

  • SHA256

    390e425860cf98fb54ce42a87c4a8a9c183e7003ac50a86e69309f2fd3605f93

  • SHA512

    337a4543adef823b246d0af717fb1f8ec4cc4bcf0470d29ff9621d5fec0a3cbc0fcaafc82e704a9ff3d267327e201dbf06f274210c1c22e986765c708a05b690

  • SSDEEP

    12288:ax84yw0x8K3EktjjhrjldjiL11qRvmDE:a5+8QEkNh6L11qn

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_d1b20ece149b4f3f35a578ffa9f77167

    • Size

      406KB

    • MD5

      d1b20ece149b4f3f35a578ffa9f77167

    • SHA1

      4362e61ba3d3304779c762d5a41bb0547407cf5b

    • SHA256

      390e425860cf98fb54ce42a87c4a8a9c183e7003ac50a86e69309f2fd3605f93

    • SHA512

      337a4543adef823b246d0af717fb1f8ec4cc4bcf0470d29ff9621d5fec0a3cbc0fcaafc82e704a9ff3d267327e201dbf06f274210c1c22e986765c708a05b690

    • SSDEEP

      12288:ax84yw0x8K3EktjjhrjldjiL11qRvmDE:a5+8QEkNh6L11qn

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks