General

  • Target

    JaffaCakes118_e2d3f250d31886a682e0d6de483d15ec

  • Size

    336KB

  • Sample

    250110-ndsspavqan

  • MD5

    e2d3f250d31886a682e0d6de483d15ec

  • SHA1

    e552462170b80d08c88ec9d2a9c753a08650072a

  • SHA256

    d2268c32e4115014a17b3347a2d6c7098106dd768afd314e8a9634a394f5e5cc

  • SHA512

    ef56e978c2afccb391ddf10b9dabca054b31b8512f192cc74570f6504d8d888793b75efc38f8aca3a3b0e49bf12c2e8bcf1b8cc3f590d834f8e1758cdfe5b737

  • SSDEEP

    6144:V7Xm77G0q5eNNA9OQdMeOB1+PHLUL9A8nAp9wf7UhOsj:V7XeG0q4yOQdfOB1+PHLUCtp9wM5j

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_e2d3f250d31886a682e0d6de483d15ec

    • Size

      336KB

    • MD5

      e2d3f250d31886a682e0d6de483d15ec

    • SHA1

      e552462170b80d08c88ec9d2a9c753a08650072a

    • SHA256

      d2268c32e4115014a17b3347a2d6c7098106dd768afd314e8a9634a394f5e5cc

    • SHA512

      ef56e978c2afccb391ddf10b9dabca054b31b8512f192cc74570f6504d8d888793b75efc38f8aca3a3b0e49bf12c2e8bcf1b8cc3f590d834f8e1758cdfe5b737

    • SSDEEP

      6144:V7Xm77G0q5eNNA9OQdMeOB1+PHLUL9A8nAp9wf7UhOsj:V7XeG0q4yOQdfOB1+PHLUCtp9wM5j

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks