General

  • Target

    93942198accc993f670296b08281adce_JaffaCakes118

  • Size

    316KB

  • Sample

    241124-kg83asyjhr

  • MD5

    93942198accc993f670296b08281adce

  • SHA1

    6863171eac609c0f85cef68592f0233a700a560f

  • SHA256

    54b01a0bef3bc887868b07bd5e000004ff4368c5182fe52993bac7c43d47920f

  • SHA512

    ae6dbf2bd93f58ae8e09d287656d29eecfccc7926c5b827d8003f0f4ad693c980f1eb2f5bccddab3169fd94d5942a95d4de18e766f3e66c960222e32e97a3d66

  • SSDEEP

    6144:QXA9aNGQBZury7+u0LAW0mEEWJSCIwY8:QX0QignsYSC5

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

C2

185.215.113.114:8887

Targets

    • Target

      93942198accc993f670296b08281adce_JaffaCakes118

    • Size

      316KB

    • MD5

      93942198accc993f670296b08281adce

    • SHA1

      6863171eac609c0f85cef68592f0233a700a560f

    • SHA256

      54b01a0bef3bc887868b07bd5e000004ff4368c5182fe52993bac7c43d47920f

    • SHA512

      ae6dbf2bd93f58ae8e09d287656d29eecfccc7926c5b827d8003f0f4ad693c980f1eb2f5bccddab3169fd94d5942a95d4de18e766f3e66c960222e32e97a3d66

    • SSDEEP

      6144:QXA9aNGQBZury7+u0LAW0mEEWJSCIwY8:QX0QignsYSC5

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks