General

  • Target

    JaffaCakes118_8eb860e8d69535bdfce4366783a74afe

  • Size

    385KB

  • Sample

    250108-gf3x4sypdm

  • MD5

    8eb860e8d69535bdfce4366783a74afe

  • SHA1

    4979c3f0d8f4c7edb21cb76cd582f02d4db0874c

  • SHA256

    ce90185f59d51d50fe8ded86244940ec026dc8f03535a82432d453a5e9cad5bb

  • SHA512

    265d7e6971be7a75632a7a7262f189313851830a15cededbee61190c3c21ee924db98f31f35f99ee96fdf9e96623382bbbd51d3521f77c5da9f728b79532647f

  • SSDEEP

    6144:U9Jo9foktQrIfPlJIw8PGG4Lvimt+tdUqyMKnrPmAwsCn:KJ4foktQgJINPH4LamYtdNKnr+lbn

Malware Config

Extracted

Family

redline

Botnet

sewPalp

C2

185.215.113.29:24645

Attributes
  • auth_value

    41d3df6d093b1e36993abf16af0d6f2d

Targets

    • Target

      JaffaCakes118_8eb860e8d69535bdfce4366783a74afe

    • Size

      385KB

    • MD5

      8eb860e8d69535bdfce4366783a74afe

    • SHA1

      4979c3f0d8f4c7edb21cb76cd582f02d4db0874c

    • SHA256

      ce90185f59d51d50fe8ded86244940ec026dc8f03535a82432d453a5e9cad5bb

    • SHA512

      265d7e6971be7a75632a7a7262f189313851830a15cededbee61190c3c21ee924db98f31f35f99ee96fdf9e96623382bbbd51d3521f77c5da9f728b79532647f

    • SSDEEP

      6144:U9Jo9foktQrIfPlJIw8PGG4Lvimt+tdUqyMKnrPmAwsCn:KJ4foktQgJINPH4LamYtdNKnr+lbn

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks