General

  • Target

    JaffaCakes118_ecb33084934db83989fd1730e9c29894

  • Size

    337KB

  • Sample

    250110-yktcxaxkeq

  • MD5

    ecb33084934db83989fd1730e9c29894

  • SHA1

    3cd9be7621b023bb4351df6fbe82316137dc69dc

  • SHA256

    28385e37069c96573350f1b6f1af3d81a45bc710d8d3497f381c75386aa91e33

  • SHA512

    0e923312b7222a7be4d6bf1dae5e49543901a268053c6801faa1da42c416b9c411238c5c01742bbad0b0f6a1063d3f6025a248f278df4873f112582ed5ca453b

  • SSDEEP

    6144:cAW7N8bcDrcLle1h8sIn4ZfuFAJaprNQ3PYIADG8elq:c97N8oWe1h8AxJaFNUYxDD

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_ecb33084934db83989fd1730e9c29894

    • Size

      337KB

    • MD5

      ecb33084934db83989fd1730e9c29894

    • SHA1

      3cd9be7621b023bb4351df6fbe82316137dc69dc

    • SHA256

      28385e37069c96573350f1b6f1af3d81a45bc710d8d3497f381c75386aa91e33

    • SHA512

      0e923312b7222a7be4d6bf1dae5e49543901a268053c6801faa1da42c416b9c411238c5c01742bbad0b0f6a1063d3f6025a248f278df4873f112582ed5ca453b

    • SSDEEP

      6144:cAW7N8bcDrcLle1h8sIn4ZfuFAJaprNQ3PYIADG8elq:c97N8oWe1h8AxJaFNUYxDD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks