General

  • Target

    e138e1960bd6841d43d40990ce57249c_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240914-256qhsscqe

  • MD5

    e138e1960bd6841d43d40990ce57249c

  • SHA1

    2bc2fb46b8270ee9a59011f2ce7e9fe26e2c6e1d

  • SHA256

    4b7b36bfba4cda750eb013f20240cbeae7c5a6ef5b8895a62ef9c5e461f59aaf

  • SHA512

    be3d9b83e8e1b24af5a4cc1788050f42f0a37a655e886a979bf0206aa80419ae017e22883709020ad10c5bee7c195c847bae4a767c2099fa85fc3bafde9e8c95

  • SSDEEP

    24576:SzN/IMFKLriziS1Ntoqr2TO88762AWWwFfYC:SzN/6i/tPCTZEW2

Malware Config

Extracted

Family

redline

C2

mhuncho.duckdns.org:81

Targets

    • Target

      e138e1960bd6841d43d40990ce57249c_JaffaCakes118

    • Size

      1.1MB

    • MD5

      e138e1960bd6841d43d40990ce57249c

    • SHA1

      2bc2fb46b8270ee9a59011f2ce7e9fe26e2c6e1d

    • SHA256

      4b7b36bfba4cda750eb013f20240cbeae7c5a6ef5b8895a62ef9c5e461f59aaf

    • SHA512

      be3d9b83e8e1b24af5a4cc1788050f42f0a37a655e886a979bf0206aa80419ae017e22883709020ad10c5bee7c195c847bae4a767c2099fa85fc3bafde9e8c95

    • SSDEEP

      24576:SzN/IMFKLriziS1Ntoqr2TO88762AWWwFfYC:SzN/6i/tPCTZEW2

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks