General

  • Target

    JaffaCakes118_3d78e9811970474cdea8fe5719273938

  • Size

    426KB

  • Sample

    250106-16bfbsslek

  • MD5

    3d78e9811970474cdea8fe5719273938

  • SHA1

    ad40ff6d5ed4c96238d7b7bfcb81f229b8ce7d59

  • SHA256

    47745cc42c96d5c599b32eb68d74710d865e047433ef6c3494b150068b4ccc10

  • SHA512

    70088a2cfdc4cac60a117ea3739323482b423e7dea3e85f628bb992d51100b51c9e58d1d036eea50e1ffdb48aa13961e8e789537807deb19220933c4fc743c1e

  • SSDEEP

    12288:hTqrxO2bs9m1vrlPI1fEaQ6854UQIj7x01/3CS6IV0:huQm1vrlA1fm6Ij7x0R9S

Malware Config

Extracted

Family

redline

Botnet

palad

C2

188.68.201.6:29795

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      JaffaCakes118_3d78e9811970474cdea8fe5719273938

    • Size

      426KB

    • MD5

      3d78e9811970474cdea8fe5719273938

    • SHA1

      ad40ff6d5ed4c96238d7b7bfcb81f229b8ce7d59

    • SHA256

      47745cc42c96d5c599b32eb68d74710d865e047433ef6c3494b150068b4ccc10

    • SHA512

      70088a2cfdc4cac60a117ea3739323482b423e7dea3e85f628bb992d51100b51c9e58d1d036eea50e1ffdb48aa13961e8e789537807deb19220933c4fc743c1e

    • SSDEEP

      12288:hTqrxO2bs9m1vrlPI1fEaQ6854UQIj7x01/3CS6IV0:huQm1vrlA1fm6Ij7x0R9S

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks