General

  • Target

    JaffaCakes118_fce3c7febe387d10ee7e4447094428bf

  • Size

    386KB

  • Sample

    250111-k1wlbawphq

  • MD5

    fce3c7febe387d10ee7e4447094428bf

  • SHA1

    030f2028d0788152314138c183bf1bcb6e26676a

  • SHA256

    8e0b80fd19a01ad0f5661c29192acd1e98370f8a41620990ea14ac43de07fac1

  • SHA512

    2b63d4f21d769f829c60a7ff4fd250682048c2db16f41d56471b6495293375ccb04c6a652284c2711c407837265fbb7119aee05f207178bc32758bd3318c888b

  • SSDEEP

    12288:/XHEsGM4eM5KeqopU0i2pMOIDQDg56PvqWxNpIYH:PH74hC/0DLVU8PvH

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

188.68.201.6:10085

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      JaffaCakes118_fce3c7febe387d10ee7e4447094428bf

    • Size

      386KB

    • MD5

      fce3c7febe387d10ee7e4447094428bf

    • SHA1

      030f2028d0788152314138c183bf1bcb6e26676a

    • SHA256

      8e0b80fd19a01ad0f5661c29192acd1e98370f8a41620990ea14ac43de07fac1

    • SHA512

      2b63d4f21d769f829c60a7ff4fd250682048c2db16f41d56471b6495293375ccb04c6a652284c2711c407837265fbb7119aee05f207178bc32758bd3318c888b

    • SSDEEP

      12288:/XHEsGM4eM5KeqopU0i2pMOIDQDg56PvqWxNpIYH:PH74hC/0DLVU8PvH

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks