General

  • Target

    43be60ff644ccc577ed3e3a9bac01d76_JaffaCakes118

  • Size

    287KB

  • Sample

    241014-xsyf6a1epb

  • MD5

    43be60ff644ccc577ed3e3a9bac01d76

  • SHA1

    46ff6eb93f93c36a260811a864f70aa44a2b3bc4

  • SHA256

    3326eff842bafe62fb6235a14abe1d8de6570b142396a194760b6a51071d3ecc

  • SHA512

    d0a26d0e37f64e0d153117f18577d1b0ea8678816b275e3f5a6fbfb5b3c9425e75d696394991fa56686c5d4497804587d7ba924b23181c644589b25606d41bd9

  • SSDEEP

    6144:nL82FwaVi+yZGnehjh180tb5sdflLecVrRg5jTwa/RxJg:noAvfet/8kb5wlLeGR6Y

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

C2

185.215.113.114:8887

Targets

    • Target

      43be60ff644ccc577ed3e3a9bac01d76_JaffaCakes118

    • Size

      287KB

    • MD5

      43be60ff644ccc577ed3e3a9bac01d76

    • SHA1

      46ff6eb93f93c36a260811a864f70aa44a2b3bc4

    • SHA256

      3326eff842bafe62fb6235a14abe1d8de6570b142396a194760b6a51071d3ecc

    • SHA512

      d0a26d0e37f64e0d153117f18577d1b0ea8678816b275e3f5a6fbfb5b3c9425e75d696394991fa56686c5d4497804587d7ba924b23181c644589b25606d41bd9

    • SSDEEP

      6144:nL82FwaVi+yZGnehjh180tb5sdflLecVrRg5jTwa/RxJg:noAvfet/8kb5wlLeGR6Y

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

MITRE ATT&CK Enterprise v15

Tasks