General

  • Target

    JaffaCakes118_cbeb5c6894f8b492d13f5be71fe5cae9

  • Size

    364KB

  • Sample

    250109-s27nzatkey

  • MD5

    cbeb5c6894f8b492d13f5be71fe5cae9

  • SHA1

    fbd05620d680ffba9fa6f551ad111cf17261a7f6

  • SHA256

    92b9be85e4aaebb09dae76933435c9c2511e66115ebe56627d2dff99b3fd4dd5

  • SHA512

    1bdb8e5099b34525b4fbd0e3df3714219fc31b69acf9005c606cdf8a2f9f0fdf81d53247a13dcc6f28c84ad6ea97ade61558a3277da2541acb9975c3c1ad25e2

  • SSDEEP

    6144:+9XpjaSuV60I9tbx/r4xU4zZn10hcZSa2ODc52vLjrZ1ya2+69iryIADG8el1:+NpjD37bxg1L0Wg4vt1PryxD0

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

188.68.201.6:10085

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      JaffaCakes118_cbeb5c6894f8b492d13f5be71fe5cae9

    • Size

      364KB

    • MD5

      cbeb5c6894f8b492d13f5be71fe5cae9

    • SHA1

      fbd05620d680ffba9fa6f551ad111cf17261a7f6

    • SHA256

      92b9be85e4aaebb09dae76933435c9c2511e66115ebe56627d2dff99b3fd4dd5

    • SHA512

      1bdb8e5099b34525b4fbd0e3df3714219fc31b69acf9005c606cdf8a2f9f0fdf81d53247a13dcc6f28c84ad6ea97ade61558a3277da2541acb9975c3c1ad25e2

    • SSDEEP

      6144:+9XpjaSuV60I9tbx/r4xU4zZn10hcZSa2ODc52vLjrZ1ya2+69iryIADG8el1:+NpjD37bxg1L0Wg4vt1PryxD0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks