General

  • Target

    JaffaCakes118_d0cf776ea71c1d2c10b0fe9e6da3dd3a

  • Size

    364KB

  • Sample

    250109-yf71ha1mfk

  • MD5

    d0cf776ea71c1d2c10b0fe9e6da3dd3a

  • SHA1

    483623f7a2e9f4073c25e45d72647728fe5e2cd4

  • SHA256

    d946346ab664704d592158a3ad2de706d92b9301ac95982f224f2069f39f1c2c

  • SHA512

    629e7d096a17f20ac657bd862b427ef0c9c1dd228d7e90be4b855ca561104f722bfd58e9c7a7344b5feb9e0e4f3fa3ba07bc1ee6b7c0030ad8fb26d1917307de

  • SSDEEP

    6144:utlntELD+fyM54SPTT87WEPU8qwiSb24XdpRIADG8el:ujntEm/P8pU8qE2eRxD

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

188.68.201.6:10085

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      JaffaCakes118_d0cf776ea71c1d2c10b0fe9e6da3dd3a

    • Size

      364KB

    • MD5

      d0cf776ea71c1d2c10b0fe9e6da3dd3a

    • SHA1

      483623f7a2e9f4073c25e45d72647728fe5e2cd4

    • SHA256

      d946346ab664704d592158a3ad2de706d92b9301ac95982f224f2069f39f1c2c

    • SHA512

      629e7d096a17f20ac657bd862b427ef0c9c1dd228d7e90be4b855ca561104f722bfd58e9c7a7344b5feb9e0e4f3fa3ba07bc1ee6b7c0030ad8fb26d1917307de

    • SSDEEP

      6144:utlntELD+fyM54SPTT87WEPU8qwiSb24XdpRIADG8el:ujntEm/P8pU8qE2eRxD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks