General

  • Target

    JaffaCakes118_dc06f2908e96e7abb35b8e2db9bb71c2

  • Size

    438KB

  • Sample

    250110-f23c2atlet

  • MD5

    dc06f2908e96e7abb35b8e2db9bb71c2

  • SHA1

    f9dc7c81923b06e3315c0e59a27a35e77cd0f8bd

  • SHA256

    5ac00c456cc96d0d96af48ac851699601151c8c24f1d7aa46cab6412126fe1c1

  • SHA512

    cb5cb066bc8e1af2cb3af1462d113251b90167c63920f9ef86d7d5a5919593bce98eebfc79c64c2ae891928985da5065b09375ea916dc3c11e74d5170fe44c41

  • SSDEEP

    12288:UO3/3/WflIiB2RwiyPaCFnUJ4Sp1HlNZScC:UMefWRwDasSp1F6

Malware Config

Extracted

Family

redline

Botnet

palad

C2

188.68.201.6:29795

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      JaffaCakes118_dc06f2908e96e7abb35b8e2db9bb71c2

    • Size

      438KB

    • MD5

      dc06f2908e96e7abb35b8e2db9bb71c2

    • SHA1

      f9dc7c81923b06e3315c0e59a27a35e77cd0f8bd

    • SHA256

      5ac00c456cc96d0d96af48ac851699601151c8c24f1d7aa46cab6412126fe1c1

    • SHA512

      cb5cb066bc8e1af2cb3af1462d113251b90167c63920f9ef86d7d5a5919593bce98eebfc79c64c2ae891928985da5065b09375ea916dc3c11e74d5170fe44c41

    • SSDEEP

      12288:UO3/3/WflIiB2RwiyPaCFnUJ4Sp1HlNZScC:UMefWRwDasSp1F6

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks