General

  • Target

    JaffaCakes118_ec2fd0800379c56fab3b254f68943169

  • Size

    394KB

  • Sample

    250110-x6p2yatmdy

  • MD5

    ec2fd0800379c56fab3b254f68943169

  • SHA1

    c0d4a34258c25c9e59f9594c45bdeee2f244fce5

  • SHA256

    9bf5502ca6f662f1883746083d6a707bf3e1223ad972e362c61b85ef8834eb7f

  • SHA512

    7ceb9abf7e3bc59a28c9c911a7c004abec7596ebdd9bb1bfdfaa12c5d9771b4ae07d69a33bedd452c2f8c89eb1483b82dfe2e3051d053e061339af7e2fae7d6e

  • SSDEEP

    6144:isKPmutfpEdoaJKm88K7l/6FTnZAqX7tNfVXVHQLIiu8cfo0/pW:ihPmif+dmV35yLAwZGEX8cA0/M

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

188.68.201.6:10085

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      JaffaCakes118_ec2fd0800379c56fab3b254f68943169

    • Size

      394KB

    • MD5

      ec2fd0800379c56fab3b254f68943169

    • SHA1

      c0d4a34258c25c9e59f9594c45bdeee2f244fce5

    • SHA256

      9bf5502ca6f662f1883746083d6a707bf3e1223ad972e362c61b85ef8834eb7f

    • SHA512

      7ceb9abf7e3bc59a28c9c911a7c004abec7596ebdd9bb1bfdfaa12c5d9771b4ae07d69a33bedd452c2f8c89eb1483b82dfe2e3051d053e061339af7e2fae7d6e

    • SSDEEP

      6144:isKPmutfpEdoaJKm88K7l/6FTnZAqX7tNfVXVHQLIiu8cfo0/pW:ihPmif+dmV35yLAwZGEX8cA0/M

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks