General

  • Target

    JaffaCakes118_f4505f24c72f0b883089966dea7b00ae

  • Size

    418KB

  • Sample

    250111-cpjhls1nfp

  • MD5

    f4505f24c72f0b883089966dea7b00ae

  • SHA1

    41ad8175ffff180281a643f386301a18becd1bd0

  • SHA256

    e7e7126e2ac5efb732a12db9d89b5da9400cdc1ddd0566e0b46f6f6090d33110

  • SHA512

    dff3755a542849543a260d3ebbd03deabc0f66d7c6e01b2265087588e6c2dbbfe87c622de779fe86586949bb674f2a74810d15ede4a8ed52ed5f8fa2ba57e4a3

  • SSDEEP

    6144:5HxUW6xraRbPXg0uHNzhqGoc/CKezf02AXAFdEeg3gQ+1WeyGSmRkVXvA:5u76Pg0kEs/CTzf0fgdEeg3gkefSme4

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_f4505f24c72f0b883089966dea7b00ae

    • Size

      418KB

    • MD5

      f4505f24c72f0b883089966dea7b00ae

    • SHA1

      41ad8175ffff180281a643f386301a18becd1bd0

    • SHA256

      e7e7126e2ac5efb732a12db9d89b5da9400cdc1ddd0566e0b46f6f6090d33110

    • SHA512

      dff3755a542849543a260d3ebbd03deabc0f66d7c6e01b2265087588e6c2dbbfe87c622de779fe86586949bb674f2a74810d15ede4a8ed52ed5f8fa2ba57e4a3

    • SSDEEP

      6144:5HxUW6xraRbPXg0uHNzhqGoc/CKezf02AXAFdEeg3gQ+1WeyGSmRkVXvA:5u76Pg0kEs/CTzf0fgdEeg3gkefSme4

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks