General

  • Target

    JaffaCakes118_e3ec22f4e537c4bf1616f470629bcdab

  • Size

    406KB

  • Sample

    250110-pcw96awmdm

  • MD5

    e3ec22f4e537c4bf1616f470629bcdab

  • SHA1

    d96fcbc48f7611e77639460787e9876d278b8f21

  • SHA256

    b14590cd4d3024c785605963d894ac296e0f60a0b55969ff68b724c5f79534dc

  • SHA512

    1049e238aba4d4f7b987689a834fe17242afcd470b67f02e57df14885ab28f85578145bd2c03d1bf3d60cc93e10a97bc7ad83d2d3b30cfa41fa11a1eb3bba1a8

  • SSDEEP

    12288:pzWMTPbquMeMX2MwIDLWGedrKC1Sh8k4St4C:pPWX2MrLfC1E88

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_e3ec22f4e537c4bf1616f470629bcdab

    • Size

      406KB

    • MD5

      e3ec22f4e537c4bf1616f470629bcdab

    • SHA1

      d96fcbc48f7611e77639460787e9876d278b8f21

    • SHA256

      b14590cd4d3024c785605963d894ac296e0f60a0b55969ff68b724c5f79534dc

    • SHA512

      1049e238aba4d4f7b987689a834fe17242afcd470b67f02e57df14885ab28f85578145bd2c03d1bf3d60cc93e10a97bc7ad83d2d3b30cfa41fa11a1eb3bba1a8

    • SSDEEP

      12288:pzWMTPbquMeMX2MwIDLWGedrKC1Sh8k4St4C:pPWX2MrLfC1E88

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks