General

  • Target

    b1e6506e5ce8c90f0045a0cb8242dad5_JaffaCakes118

  • Size

    322KB

  • Sample

    241129-r1clrsvpdk

  • MD5

    b1e6506e5ce8c90f0045a0cb8242dad5

  • SHA1

    29cdf4bec210ee0365c921e62a68a1da68e2407b

  • SHA256

    cbf1fa770edbb68d59a26a1c93b3ae87792e6a6951f3487433f44a26baa2b284

  • SHA512

    03c6734e756fda960fe1251e460f04bd191019cd7a5ef0be20596a81efc866ef42cf7963c274aa9c49a2b123f287f312c23160c9d51e9ae9db19693b9a9413f9

  • SSDEEP

    6144:pgs4J7MbKXtHpCtD7snxeMIKqduWWCIwCK:Ks4J7MmdHgD0xVIKp9C5C

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

C2

185.215.113.114:8887

Targets

    • Target

      b1e6506e5ce8c90f0045a0cb8242dad5_JaffaCakes118

    • Size

      322KB

    • MD5

      b1e6506e5ce8c90f0045a0cb8242dad5

    • SHA1

      29cdf4bec210ee0365c921e62a68a1da68e2407b

    • SHA256

      cbf1fa770edbb68d59a26a1c93b3ae87792e6a6951f3487433f44a26baa2b284

    • SHA512

      03c6734e756fda960fe1251e460f04bd191019cd7a5ef0be20596a81efc866ef42cf7963c274aa9c49a2b123f287f312c23160c9d51e9ae9db19693b9a9413f9

    • SSDEEP

      6144:pgs4J7MbKXtHpCtD7snxeMIKqduWWCIwCK:Ks4J7MmdHgD0xVIKp9C5C

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks