General

  • Target

    JaffaCakes118_f811d5b30ca6ed0fcf6ed8a1f7f8541e

  • Size

    384KB

  • Sample

    250111-f2vyyswlez

  • MD5

    f811d5b30ca6ed0fcf6ed8a1f7f8541e

  • SHA1

    4aec8c67f1b4f5533c5546b0658c45c44d13db6b

  • SHA256

    8e4f6b82aee747b662a9f88af10f828f5989bcfa3213e136d67d3418baae194a

  • SHA512

    a06d58b15be433c2a2ad831d1221f5e4c1f4ebdf92836fbb20e1f282dc8ca0f75f3ea8d676b594dbf148011a56ebf2a08c006610bb0d415365847013eb58ca1e

  • SSDEEP

    12288:Ow2u8w4nZ9G8+eaDCPzePnb+/xStUEKI:R8Vn+8+JDRTwx

Malware Config

Extracted

Family

redline

Botnet

part1

C2

45.9.20.107:46187

Attributes
  • auth_value

    60c75f1e2d31f6bac6dd7edad67d8615

Targets

    • Target

      JaffaCakes118_f811d5b30ca6ed0fcf6ed8a1f7f8541e

    • Size

      384KB

    • MD5

      f811d5b30ca6ed0fcf6ed8a1f7f8541e

    • SHA1

      4aec8c67f1b4f5533c5546b0658c45c44d13db6b

    • SHA256

      8e4f6b82aee747b662a9f88af10f828f5989bcfa3213e136d67d3418baae194a

    • SHA512

      a06d58b15be433c2a2ad831d1221f5e4c1f4ebdf92836fbb20e1f282dc8ca0f75f3ea8d676b594dbf148011a56ebf2a08c006610bb0d415365847013eb58ca1e

    • SSDEEP

      12288:Ow2u8w4nZ9G8+eaDCPzePnb+/xStUEKI:R8Vn+8+JDRTwx

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks