General

  • Target

    JaffaCakes118_68d530f2f8edecf312e26f454cd2c57b

  • Size

    364KB

  • Sample

    250107-r32cxavqct

  • MD5

    68d530f2f8edecf312e26f454cd2c57b

  • SHA1

    09122856a0ad8823a59a571d5014d7929f613a7e

  • SHA256

    b5b2d0d4889ee590ff3e8c60686f6103780102951574f44d955579b1f11f9e16

  • SHA512

    84872c39a40f023496f4693509aabac713ad39cdcef25bc88d9f7e055b5efb4738c1d6c9b932b940fb46b15cb18fd1873acc7884705c4ed2a4f954a82f031c2e

  • SSDEEP

    6144:BFxuXpbvsKVZuVIA/h93MRfmfxEBMb6yQpB/VBDGjE1U2RYIADG8elR:B/uXFvsKVEVrpQe5qM2yApVJGwZYxDs

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

188.68.201.6:10085

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      JaffaCakes118_68d530f2f8edecf312e26f454cd2c57b

    • Size

      364KB

    • MD5

      68d530f2f8edecf312e26f454cd2c57b

    • SHA1

      09122856a0ad8823a59a571d5014d7929f613a7e

    • SHA256

      b5b2d0d4889ee590ff3e8c60686f6103780102951574f44d955579b1f11f9e16

    • SHA512

      84872c39a40f023496f4693509aabac713ad39cdcef25bc88d9f7e055b5efb4738c1d6c9b932b940fb46b15cb18fd1873acc7884705c4ed2a4f954a82f031c2e

    • SSDEEP

      6144:BFxuXpbvsKVZuVIA/h93MRfmfxEBMb6yQpB/VBDGjE1U2RYIADG8elR:B/uXFvsKVEVrpQe5qM2yApVJGwZYxDs

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks