General

  • Target

    JaffaCakes118_dd77412557cfbfebe8b16ed0fce69ab3

  • Size

    336KB

  • Sample

    250110-heve1svrc1

  • MD5

    dd77412557cfbfebe8b16ed0fce69ab3

  • SHA1

    d2e128a711f24a4f705addac81f9c2ff341ccfbf

  • SHA256

    7ecaca6f4be593855ebd927eb0330f3aab210e313b449278af58b24465106031

  • SHA512

    9094b22cd3347a04e09454c48f8991e15b76519ea8390065162ab0999017dd4f541bfa2b75ace1b286ea5f230a04cd1204c503a5c1c16df97149b66d277d3b87

  • SSDEEP

    6144:PolDPnLGnEIDaivp9R/Pjn5yNoWA4J7uuUAs5mxzAQq/s/5U:PoNFIDaiFTLD4J7uuUAdxzA0

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_dd77412557cfbfebe8b16ed0fce69ab3

    • Size

      336KB

    • MD5

      dd77412557cfbfebe8b16ed0fce69ab3

    • SHA1

      d2e128a711f24a4f705addac81f9c2ff341ccfbf

    • SHA256

      7ecaca6f4be593855ebd927eb0330f3aab210e313b449278af58b24465106031

    • SHA512

      9094b22cd3347a04e09454c48f8991e15b76519ea8390065162ab0999017dd4f541bfa2b75ace1b286ea5f230a04cd1204c503a5c1c16df97149b66d277d3b87

    • SSDEEP

      6144:PolDPnLGnEIDaivp9R/Pjn5yNoWA4J7uuUAs5mxzAQq/s/5U:PoNFIDaiFTLD4J7uuUAdxzA0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks