General

  • Target

    JaffaCakes118_e5e208690e7035dbf66f341566852601

  • Size

    337KB

  • Sample

    250110-q5hg5swjfw

  • MD5

    e5e208690e7035dbf66f341566852601

  • SHA1

    8f4eda3dad603a3c4717a99e6fec717615ebe018

  • SHA256

    13278e757dccc1aaf91f9c0f98965324dc18e8b4e7676f11fb570aaa8f41ca7d

  • SHA512

    238e1a2d8f0acc34448c593270563d25181efea4e30d4ea5f8c495d30b956728330103a6227ca36330ed7b9bddce74899d3840838502e50e5dd4a13dd6468248

  • SSDEEP

    6144:VCFEjipDe6RKucIUDX/LRhBAMEoMKPSprHUd9A8BGtdaLmOLJ:V8uJucIkzszKPSprHUEttdanLJ

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_e5e208690e7035dbf66f341566852601

    • Size

      337KB

    • MD5

      e5e208690e7035dbf66f341566852601

    • SHA1

      8f4eda3dad603a3c4717a99e6fec717615ebe018

    • SHA256

      13278e757dccc1aaf91f9c0f98965324dc18e8b4e7676f11fb570aaa8f41ca7d

    • SHA512

      238e1a2d8f0acc34448c593270563d25181efea4e30d4ea5f8c495d30b956728330103a6227ca36330ed7b9bddce74899d3840838502e50e5dd4a13dd6468248

    • SSDEEP

      6144:VCFEjipDe6RKucIUDX/LRhBAMEoMKPSprHUd9A8BGtdaLmOLJ:V8uJucIkzszKPSprHUEttdanLJ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks