General

  • Target

    JaffaCakes118_bbe37ddc14574c30d8b8fadb610920fb

  • Size

    366KB

  • Sample

    250109-eaqpgswrdw

  • MD5

    bbe37ddc14574c30d8b8fadb610920fb

  • SHA1

    e9785e7d4ef85ba851d9a828ec15246e8e9fa0d2

  • SHA256

    dcbea86db917e0a57952c7de2cff32816eba755acc267d1f14e9823533ca5579

  • SHA512

    469724185025507246db1ae9e513c357d55a2ffaa130051877d16e906cb724b89d7cd8f6aea91e50be117cca9eda938c43a647e786c7f195986874a0e2ccdfcc

  • SSDEEP

    6144:NFfusc5msJu5lZKWDnYQN6wDX/rYcRstfS5deEOnw:LfusamSuXZuQMwDX/rLstf+Itnw

Malware Config

Extracted

Family

redline

Botnet

sewPalp

C2

185.215.113.29:24645

Attributes
  • auth_value

    41d3df6d093b1e36993abf16af0d6f2d

Targets

    • Target

      JaffaCakes118_bbe37ddc14574c30d8b8fadb610920fb

    • Size

      366KB

    • MD5

      bbe37ddc14574c30d8b8fadb610920fb

    • SHA1

      e9785e7d4ef85ba851d9a828ec15246e8e9fa0d2

    • SHA256

      dcbea86db917e0a57952c7de2cff32816eba755acc267d1f14e9823533ca5579

    • SHA512

      469724185025507246db1ae9e513c357d55a2ffaa130051877d16e906cb724b89d7cd8f6aea91e50be117cca9eda938c43a647e786c7f195986874a0e2ccdfcc

    • SSDEEP

      6144:NFfusc5msJu5lZKWDnYQN6wDX/rYcRstfS5deEOnw:LfusamSuXZuQMwDX/rLstf+Itnw

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks