General

  • Target

    JaffaCakes118_f5577eee21c6765ac2cd8a075243c8c6

  • Size

    405KB

  • Sample

    250111-dnd26s1kax

  • MD5

    f5577eee21c6765ac2cd8a075243c8c6

  • SHA1

    f1a3416ee9e3439db9464c9ed3d55119bde4369d

  • SHA256

    733fe2ddf9b1e77df5237ab7a0b0fe68f6c4515dab291ea4744ed47256bc0ed7

  • SHA512

    b7a4794d6095979b0158665d523e5821a904d1eb6db2290113ab5ea24cf753ce40d1d1f42394013f1fdb09a16f12f1c50759ddee5f113eb09874c0b405271648

  • SSDEEP

    6144:qZPlCTmvE0y9YZoNSuO7ks2yF9fqm3Ich4XdL2Q+lo9B/+y/W55rV:qllH801WnyF9ym3IYYdL2Q+u7++W57

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_f5577eee21c6765ac2cd8a075243c8c6

    • Size

      405KB

    • MD5

      f5577eee21c6765ac2cd8a075243c8c6

    • SHA1

      f1a3416ee9e3439db9464c9ed3d55119bde4369d

    • SHA256

      733fe2ddf9b1e77df5237ab7a0b0fe68f6c4515dab291ea4744ed47256bc0ed7

    • SHA512

      b7a4794d6095979b0158665d523e5821a904d1eb6db2290113ab5ea24cf753ce40d1d1f42394013f1fdb09a16f12f1c50759ddee5f113eb09874c0b405271648

    • SSDEEP

      6144:qZPlCTmvE0y9YZoNSuO7ks2yF9fqm3Ich4XdL2Q+lo9B/+y/W55rV:qllH801WnyF9ym3IYYdL2Q+u7++W57

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks