General

  • Target

    JaffaCakes118_1dbcbfed7692847938ebdb365e3686a5

  • Size

    438KB

  • Sample

    241231-qgc8hstrdp

  • MD5

    1dbcbfed7692847938ebdb365e3686a5

  • SHA1

    93c90d846e37b58cb1d2c8024b5b2099680d925d

  • SHA256

    484ad0052fd904628060db122b2f4cd7ce9d6cdbd3bc7e8d09fecb83e7f30264

  • SHA512

    5ada3ec77ecdb937ce02cfbc5db4ca1389e8340066c4e99cc4d62b42abdd733a88087af2219a92675992e735d2685466a8b637043ff9c18c9c633a2098ce5e43

  • SSDEEP

    12288:OqXpuYZhNrzri5+Zs4V4+CfURUgxKczC4YWGU0:OqZu0TIusB+CQKczvk

Malware Config

Extracted

Family

redline

Botnet

palad

C2

188.68.201.6:29795

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      JaffaCakes118_1dbcbfed7692847938ebdb365e3686a5

    • Size

      438KB

    • MD5

      1dbcbfed7692847938ebdb365e3686a5

    • SHA1

      93c90d846e37b58cb1d2c8024b5b2099680d925d

    • SHA256

      484ad0052fd904628060db122b2f4cd7ce9d6cdbd3bc7e8d09fecb83e7f30264

    • SHA512

      5ada3ec77ecdb937ce02cfbc5db4ca1389e8340066c4e99cc4d62b42abdd733a88087af2219a92675992e735d2685466a8b637043ff9c18c9c633a2098ce5e43

    • SSDEEP

      12288:OqXpuYZhNrzri5+Zs4V4+CfURUgxKczC4YWGU0:OqZu0TIusB+CQKczvk

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks