General

  • Target

    JaffaCakes118_f55bd97378afcc80b72d45e9af1fe842

  • Size

    417KB

  • Sample

    250111-dntsma1kcv

  • MD5

    f55bd97378afcc80b72d45e9af1fe842

  • SHA1

    c4c0ad8344be8c8f43e393b92755a9b69e136047

  • SHA256

    05610322ff45d0d86c80a0ef2fea524c241a4d78ae6da6b0dd5c59c64a20e56f

  • SHA512

    f022a09d4f4ae368a74e5665950c14f6a07cbe67fa3777e24fb86010b6a408b88380cf4698a00e2ca9c478ec5b5f70b8b1eacd67e0302e48c995d65d0e1c7254

  • SSDEEP

    6144:E6eUcNthNsU88onRWVGh26WdB1oYuIciWUOI07csQod2i3V9kFvxysGFDATjMT:ETNnq3gn4iWVI07dfd2i3V9ExVGFAI

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Targets

    • Target

      JaffaCakes118_f55bd97378afcc80b72d45e9af1fe842

    • Size

      417KB

    • MD5

      f55bd97378afcc80b72d45e9af1fe842

    • SHA1

      c4c0ad8344be8c8f43e393b92755a9b69e136047

    • SHA256

      05610322ff45d0d86c80a0ef2fea524c241a4d78ae6da6b0dd5c59c64a20e56f

    • SHA512

      f022a09d4f4ae368a74e5665950c14f6a07cbe67fa3777e24fb86010b6a408b88380cf4698a00e2ca9c478ec5b5f70b8b1eacd67e0302e48c995d65d0e1c7254

    • SSDEEP

      6144:E6eUcNthNsU88onRWVGh26WdB1oYuIciWUOI07csQod2i3V9kFvxysGFDATjMT:ETNnq3gn4iWVI07dfd2i3V9ExVGFAI

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks