General

  • Target

    0ba8d3824b3712fcdab59f6329f45ff3_JaffaCakes118

  • Size

    276KB

  • Sample

    241002-vekxssxblm

  • MD5

    0ba8d3824b3712fcdab59f6329f45ff3

  • SHA1

    0f1a26c5c609a45a52cfb56cfd4428c10f25eb83

  • SHA256

    4023763ad7b1f3cae1395dcfbfb15317c006526c355914ecf7d8506696e3b1ce

  • SHA512

    efc5f5cfffc00a279e74eddaed17022271f45a78decfc8a6a90bcdcc3dc81efe103e3ad687fc1077a38172f48bf4b9ee38083d1495900647500ecc7b2aeeff05

  • SSDEEP

    3072:7bL59aCyQdngr5WuYsOyM2vnUEl2hRhWXJ9BmA8heyhQZCVbKkudRj8a4RO6SWgo:7bL5yWu42vSR8ZHmA8Vb2pOROz0Ci

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

C2

185.215.113.114:8887

Targets

    • Target

      0ba8d3824b3712fcdab59f6329f45ff3_JaffaCakes118

    • Size

      276KB

    • MD5

      0ba8d3824b3712fcdab59f6329f45ff3

    • SHA1

      0f1a26c5c609a45a52cfb56cfd4428c10f25eb83

    • SHA256

      4023763ad7b1f3cae1395dcfbfb15317c006526c355914ecf7d8506696e3b1ce

    • SHA512

      efc5f5cfffc00a279e74eddaed17022271f45a78decfc8a6a90bcdcc3dc81efe103e3ad687fc1077a38172f48bf4b9ee38083d1495900647500ecc7b2aeeff05

    • SSDEEP

      3072:7bL59aCyQdngr5WuYsOyM2vnUEl2hRhWXJ9BmA8heyhQZCVbKkudRj8a4RO6SWgo:7bL5yWu42vSR8ZHmA8Vb2pOROz0Ci

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks