General

  • Target

    JaffaCakes118_08204edf80d6ea11bfa7860187cd2149

  • Size

    364KB

  • Sample

    250106-chntravlgn

  • MD5

    08204edf80d6ea11bfa7860187cd2149

  • SHA1

    d447ce2a738dd371a536795fd4102047f73535f2

  • SHA256

    e8c33c941b4c1f754f9d75d7ba2e2b07441421240877adc557f6b0ee75a5ada3

  • SHA512

    b24cc1f332db490b800b169cfc97389fe4bdee8b88e7f46afe7ad1c29e86899cb5bba27280dc350ce1ea957b39c465a90bfa5eeb3adf4fc29764364c291fc35d

  • SSDEEP

    6144:3tlntEO/vU+2W9KDSfmUGFS28AEWwbVn9qVCJlvqxxtKuIADG8el:3jntEO/8ngfmUGFO5h9qeR0KuxD

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

188.68.201.6:10085

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      JaffaCakes118_08204edf80d6ea11bfa7860187cd2149

    • Size

      364KB

    • MD5

      08204edf80d6ea11bfa7860187cd2149

    • SHA1

      d447ce2a738dd371a536795fd4102047f73535f2

    • SHA256

      e8c33c941b4c1f754f9d75d7ba2e2b07441421240877adc557f6b0ee75a5ada3

    • SHA512

      b24cc1f332db490b800b169cfc97389fe4bdee8b88e7f46afe7ad1c29e86899cb5bba27280dc350ce1ea957b39c465a90bfa5eeb3adf4fc29764364c291fc35d

    • SSDEEP

      6144:3tlntEO/vU+2W9KDSfmUGFS28AEWwbVn9qVCJlvqxxtKuIADG8el:3jntEO/8ngfmUGFO5h9qeR0KuxD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks