General

  • Target

    JaffaCakes118_bb646b7551dbd76d97bac1e594c26324

  • Size

    370KB

  • Sample

    250109-d2jvksyper

  • MD5

    bb646b7551dbd76d97bac1e594c26324

  • SHA1

    81a46f6a358be496a39a55aa35da2767fc9995a5

  • SHA256

    954847e00e9f85ff3fc485b5b99979e12623776604041d09d7ea07de579e790e

  • SHA512

    23b17ec4b5eacba625aa2fb8e1429ef558df06d00f460abdff8b81006d1cba3cd74820e3390103c94bc08d32be8c9bcd8b3814ba32ed226cc9f70aee31190079

  • SSDEEP

    6144:pLnDPIpXeia6t7w29XN11tq/9YA6ZAQUWdx8A:9DPiuROD1tq/9oZAQrX8A

Malware Config

Extracted

Family

redline

Botnet

sewPalp

C2

185.215.113.29:24645

Attributes
  • auth_value

    41d3df6d093b1e36993abf16af0d6f2d

Targets

    • Target

      JaffaCakes118_bb646b7551dbd76d97bac1e594c26324

    • Size

      370KB

    • MD5

      bb646b7551dbd76d97bac1e594c26324

    • SHA1

      81a46f6a358be496a39a55aa35da2767fc9995a5

    • SHA256

      954847e00e9f85ff3fc485b5b99979e12623776604041d09d7ea07de579e790e

    • SHA512

      23b17ec4b5eacba625aa2fb8e1429ef558df06d00f460abdff8b81006d1cba3cd74820e3390103c94bc08d32be8c9bcd8b3814ba32ed226cc9f70aee31190079

    • SSDEEP

      6144:pLnDPIpXeia6t7w29XN11tq/9YA6ZAQUWdx8A:9DPiuROD1tq/9oZAQrX8A

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks