General

  • Target

    JaffaCakes118_fe3ea8de5f5b0517abe88454807ddd20

  • Size

    364KB

  • Sample

    250111-l556zsylej

  • MD5

    fe3ea8de5f5b0517abe88454807ddd20

  • SHA1

    d4c3230655a51237c430b31f4962b60b5d722759

  • SHA256

    b6935ecaa6d67672332767ec8ebb45f3c124bbd1698def0131950d566c71a067

  • SHA512

    0db4e73f9b317a2923697495a3cff6899751ee4ffc9e81118c12354e2577f23519c83bc583159b5552bb857712cebfdd5a272cfdf32662079f331a9d43a00924

  • SSDEEP

    6144:+VxkNcMxkcUwlUQ8a/pJEpWGDADZJa9By0ewpZISrWHtjJGIADG8el:+vkNcMqcqafWWzQ9F4S+sxD

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

188.68.201.6:10085

Attributes
  • auth_value

    f27db372188045eefdf974196ead3dae

Targets

    • Target

      JaffaCakes118_fe3ea8de5f5b0517abe88454807ddd20

    • Size

      364KB

    • MD5

      fe3ea8de5f5b0517abe88454807ddd20

    • SHA1

      d4c3230655a51237c430b31f4962b60b5d722759

    • SHA256

      b6935ecaa6d67672332767ec8ebb45f3c124bbd1698def0131950d566c71a067

    • SHA512

      0db4e73f9b317a2923697495a3cff6899751ee4ffc9e81118c12354e2577f23519c83bc583159b5552bb857712cebfdd5a272cfdf32662079f331a9d43a00924

    • SSDEEP

      6144:+VxkNcMxkcUwlUQ8a/pJEpWGDADZJa9By0ewpZISrWHtjJGIADG8el:+vkNcMqcqafWWzQ9F4S+sxD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

MITRE ATT&CK Enterprise v15

Tasks