General

  • Target

    JaffaCakes118_1facf16b6b30a9c435075bef502ff4e1

  • Size

    427KB

  • Sample

    241231-q39tlsvrbj

  • MD5

    1facf16b6b30a9c435075bef502ff4e1

  • SHA1

    365aa726477e197a2766c4da026239a97fea7a02

  • SHA256

    6997dbf5b55a6b38c20ba94555a0a54bb612a893818bacf6c5841a2f9285b733

  • SHA512

    026fb8198b924f5cab559ff77f23755c9860a67fbaa62aab73db1bbc823e10d2369122754a6e8ae9dfc4ee2917e71e9fe8bc5ed411843b32b8bedccf497974fe

  • SSDEEP

    12288:tiwrdT52bU3j+bUMnqqG0XWBiZULA2/PEIB5eDSiY:t155KUz+bUfqlWegPEy

Malware Config

Extracted

Family

redline

Botnet

palad

C2

188.68.201.6:29795

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      JaffaCakes118_1facf16b6b30a9c435075bef502ff4e1

    • Size

      427KB

    • MD5

      1facf16b6b30a9c435075bef502ff4e1

    • SHA1

      365aa726477e197a2766c4da026239a97fea7a02

    • SHA256

      6997dbf5b55a6b38c20ba94555a0a54bb612a893818bacf6c5841a2f9285b733

    • SHA512

      026fb8198b924f5cab559ff77f23755c9860a67fbaa62aab73db1bbc823e10d2369122754a6e8ae9dfc4ee2917e71e9fe8bc5ed411843b32b8bedccf497974fe

    • SSDEEP

      12288:tiwrdT52bU3j+bUMnqqG0XWBiZULA2/PEIB5eDSiY:t155KUz+bUfqlWegPEy

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks