General

  • Target

    JaffaCakes118_49b769f67fe09869c271a0c8115e32d0

  • Size

    406KB

  • Sample

    250107-dgtt2s1lby

  • MD5

    49b769f67fe09869c271a0c8115e32d0

  • SHA1

    c8a6ab19fd02ebd01afb0acadf1b2a3d542df356

  • SHA256

    04925bf3c85303a846bedce6766addc4908e7277bb2e2007d77176cfa16c336d

  • SHA512

    85c922a96610d73408974e33a44ca4d26f921af3779227afd08f27c0329a4898bdb912cd69079515eef26aae947e080c7e42a50bf5fb27777b1590d0c03c33d2

  • SSDEEP

    12288:hN+rnEo0tWvMYNsTO8Qjd++VKXB12Zm3kkm:hNynCYvMY2OuAKXB1mJ

Malware Config

Extracted

Family

redline

Botnet

sewPalp

C2

185.215.113.29:24645

Attributes
  • auth_value

    41d3df6d093b1e36993abf16af0d6f2d

Targets

    • Target

      JaffaCakes118_49b769f67fe09869c271a0c8115e32d0

    • Size

      406KB

    • MD5

      49b769f67fe09869c271a0c8115e32d0

    • SHA1

      c8a6ab19fd02ebd01afb0acadf1b2a3d542df356

    • SHA256

      04925bf3c85303a846bedce6766addc4908e7277bb2e2007d77176cfa16c336d

    • SHA512

      85c922a96610d73408974e33a44ca4d26f921af3779227afd08f27c0329a4898bdb912cd69079515eef26aae947e080c7e42a50bf5fb27777b1590d0c03c33d2

    • SSDEEP

      12288:hN+rnEo0tWvMYNsTO8Qjd++VKXB12Zm3kkm:hNynCYvMY2OuAKXB1mJ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks