General

  • Target

    JaffaCakes118_32a43fccaf3d31ee32bfd7d11f9ca94c

  • Size

    364KB

  • Sample

    250106-wqr1xsvqem

  • MD5

    32a43fccaf3d31ee32bfd7d11f9ca94c

  • SHA1

    ab98f57a5e8157d6b6ee87fd8923a0679420c550

  • SHA256

    0e46980b3f0302aa86f638e0f9f101ea582dbd7b572da6fcaa8279773974308f

  • SHA512

    48fde53df4dca5dbe3a911f6062c6e3d93bfec7b2e425ba76125469383dfe75e06e5c791ddd642ead2a5343c20a1e408a4ab78ae82a95bf249dd70cb47bba857

  • SSDEEP

    6144:SxUz5VnMpdt1FEZvt/p3HoCnS/Svg9thU54KqX7tNfVXVHQLIiu8c:SxyVnM7jFENlVHFnD49jKwZGEX8c

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

188.68.201.6:10085

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      JaffaCakes118_32a43fccaf3d31ee32bfd7d11f9ca94c

    • Size

      364KB

    • MD5

      32a43fccaf3d31ee32bfd7d11f9ca94c

    • SHA1

      ab98f57a5e8157d6b6ee87fd8923a0679420c550

    • SHA256

      0e46980b3f0302aa86f638e0f9f101ea582dbd7b572da6fcaa8279773974308f

    • SHA512

      48fde53df4dca5dbe3a911f6062c6e3d93bfec7b2e425ba76125469383dfe75e06e5c791ddd642ead2a5343c20a1e408a4ab78ae82a95bf249dd70cb47bba857

    • SSDEEP

      6144:SxUz5VnMpdt1FEZvt/p3HoCnS/Svg9thU54KqX7tNfVXVHQLIiu8c:SxyVnM7jFENlVHFnD49jKwZGEX8c

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks