General

  • Target

    JaffaCakes118_e5ab3d41fc60758771434f427b70d111

  • Size

    407KB

  • Sample

    250110-qykc6axqdk

  • MD5

    e5ab3d41fc60758771434f427b70d111

  • SHA1

    763f94dffd6f4f59277dabbe45fcb9dfca8d9549

  • SHA256

    93294643db670f6f44f6a95a3f19b813d889f68dc1dd3c74fc72645444f4ab2e

  • SHA512

    e8b8230da0643afac847752ea008149a3aaf574fa7f9fe28f5f3a48b6e8dd923255f2821a8c9955786312d1817ae5d1dccc2539be2b8bfeac7e830d842612809

  • SSDEEP

    12288:O+NJAy/zSrSwJJbD9/NmV0v0vodoS43gkefSk:O+NJnurSIdNrvt43gk

Malware Config

Extracted

Family

redline

Botnet

sewPalp

C2

185.215.113.29:24645

Attributes
  • auth_value

    41d3df6d093b1e36993abf16af0d6f2d

Targets

    • Target

      JaffaCakes118_e5ab3d41fc60758771434f427b70d111

    • Size

      407KB

    • MD5

      e5ab3d41fc60758771434f427b70d111

    • SHA1

      763f94dffd6f4f59277dabbe45fcb9dfca8d9549

    • SHA256

      93294643db670f6f44f6a95a3f19b813d889f68dc1dd3c74fc72645444f4ab2e

    • SHA512

      e8b8230da0643afac847752ea008149a3aaf574fa7f9fe28f5f3a48b6e8dd923255f2821a8c9955786312d1817ae5d1dccc2539be2b8bfeac7e830d842612809

    • SSDEEP

      12288:O+NJAy/zSrSwJJbD9/NmV0v0vodoS43gkefSk:O+NJnurSIdNrvt43gk

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks