General

  • Target

    JaffaCakes118_d93c0515a4eb4097a9a8244ed4e8051e

  • Size

    364KB

  • Sample

    250110-dkgc5azldv

  • MD5

    d93c0515a4eb4097a9a8244ed4e8051e

  • SHA1

    4a5e2cbb31119a7084284f861b991c34cfc99054

  • SHA256

    0ac2d74912471b3afd9e11081584eba3b8b8387b28182fcb053f42167c9ad6ab

  • SHA512

    5968e44ab95efdb35072e7f18a4641f8ec13a331b2eef1182ecf332d8bbde3f28135c8a4b4e5c7f88049bcb9585ae81c4e472bd5270e8e61c10f165d2a6a8278

  • SSDEEP

    6144:75tCeX9DGzsob/lerk4StzUm3ti+Rae2bd23IADG8elR:75geX5qBldni+Od23xDE

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

188.68.201.6:10085

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      JaffaCakes118_d93c0515a4eb4097a9a8244ed4e8051e

    • Size

      364KB

    • MD5

      d93c0515a4eb4097a9a8244ed4e8051e

    • SHA1

      4a5e2cbb31119a7084284f861b991c34cfc99054

    • SHA256

      0ac2d74912471b3afd9e11081584eba3b8b8387b28182fcb053f42167c9ad6ab

    • SHA512

      5968e44ab95efdb35072e7f18a4641f8ec13a331b2eef1182ecf332d8bbde3f28135c8a4b4e5c7f88049bcb9585ae81c4e472bd5270e8e61c10f165d2a6a8278

    • SSDEEP

      6144:75tCeX9DGzsob/lerk4StzUm3ti+Rae2bd23IADG8elR:75geX5qBldni+Od23xDE

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks