General

  • Target

    JaffaCakes118_9f497f51e68d6bb3edce68435841d5ab

  • Size

    385KB

  • Sample

    250108-pmlamsskem

  • MD5

    9f497f51e68d6bb3edce68435841d5ab

  • SHA1

    0caf2678d7e76741dcb8015e828e7a7560fd38a6

  • SHA256

    03f7ee61dd4d9dd92356137c0abbd346e20c0753c2d435d0e0af5b0fc355c899

  • SHA512

    1c0cd943565b1baacd9f9f5ffb4808942804b48c648eec6f84ea0b808df429bc50c177153a110ed7ebcc0961b0a2cb5d87bac7af11829d2ffecff7c63d65f24e

  • SSDEEP

    6144:lGpaHCn4dJTtfC7ldX4pLBwvNX/nyEbtMSm3t3GdaAnf5C:lGpZnQJpYll45BwFvnyEKV3tW4wC

Malware Config

Extracted

Family

redline

Botnet

sewPalp

C2

185.215.113.29:24645

Attributes
  • auth_value

    41d3df6d093b1e36993abf16af0d6f2d

Targets

    • Target

      JaffaCakes118_9f497f51e68d6bb3edce68435841d5ab

    • Size

      385KB

    • MD5

      9f497f51e68d6bb3edce68435841d5ab

    • SHA1

      0caf2678d7e76741dcb8015e828e7a7560fd38a6

    • SHA256

      03f7ee61dd4d9dd92356137c0abbd346e20c0753c2d435d0e0af5b0fc355c899

    • SHA512

      1c0cd943565b1baacd9f9f5ffb4808942804b48c648eec6f84ea0b808df429bc50c177153a110ed7ebcc0961b0a2cb5d87bac7af11829d2ffecff7c63d65f24e

    • SSDEEP

      6144:lGpaHCn4dJTtfC7ldX4pLBwvNX/nyEbtMSm3t3GdaAnf5C:lGpZnQJpYll45BwFvnyEKV3tW4wC

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks