General

  • Target

    40606d2f4fbc0bfd653571f6d6687c0c_JaffaCakes118

  • Size

    387KB

  • Sample

    241013-rvxdzs1enf

  • MD5

    40606d2f4fbc0bfd653571f6d6687c0c

  • SHA1

    60ded32798edecf1be3a9f3bbf52c30954267da4

  • SHA256

    cc2bef9329a741ecf4c4b92d6af68a78a7de8165b4876d598998abc6dd1a7903

  • SHA512

    14988aedfa66f7587d8c6a019ea5d135d1720a6f98a2b7ef77249edc9ed36081f2ae0a112d757ec396434a83dc809bac5931a70267048b2b1e8338c1de9d6e67

  • SSDEEP

    6144:viFwBxMvZV6sie3Ko/v3JfI0DIWcKIuS/CwdNxwhNJHZiP7aRw9r5w:ewBmXNiIZnJfI01cHzx4V4P7e6y

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

C2

185.215.113.114:8887

Targets

    • Target

      40606d2f4fbc0bfd653571f6d6687c0c_JaffaCakes118

    • Size

      387KB

    • MD5

      40606d2f4fbc0bfd653571f6d6687c0c

    • SHA1

      60ded32798edecf1be3a9f3bbf52c30954267da4

    • SHA256

      cc2bef9329a741ecf4c4b92d6af68a78a7de8165b4876d598998abc6dd1a7903

    • SHA512

      14988aedfa66f7587d8c6a019ea5d135d1720a6f98a2b7ef77249edc9ed36081f2ae0a112d757ec396434a83dc809bac5931a70267048b2b1e8338c1de9d6e67

    • SSDEEP

      6144:viFwBxMvZV6sie3Ko/v3JfI0DIWcKIuS/CwdNxwhNJHZiP7aRw9r5w:ewBmXNiIZnJfI01cHzx4V4P7e6y

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks