General

  • Target

    e9dcca2fb4c88845b8cbd59b9a4ffbe5_JaffaCakes118

  • Size

    958KB

  • Sample

    240918-yklcaszfrg

  • MD5

    e9dcca2fb4c88845b8cbd59b9a4ffbe5

  • SHA1

    5a9463cd82f32952ba32c6c05d5cfa7cb9730b90

  • SHA256

    cc86256ed3684fb47c6f633bb1c862d7ed3ccb98b8303ddc785c063b75e2463f

  • SHA512

    dd48e26e87acb280d144d8a09d102d5479caad744958cecc6a74105e78ca310359b30343a6cb2e1cf0063ca4af30d38699aae215cf0ebac895ad04cfe956ed4b

  • SSDEEP

    12288:d3l9S58EV10F3wZa7e5QsbVcEIhqkIHq0dzSzxqx6fm2xy:d3l9w1/oeTcB7Ry

Malware Config

Extracted

Family

redline

Botnet

0000

C2

148.251.13.126:81

Targets

    • Target

      e9dcca2fb4c88845b8cbd59b9a4ffbe5_JaffaCakes118

    • Size

      958KB

    • MD5

      e9dcca2fb4c88845b8cbd59b9a4ffbe5

    • SHA1

      5a9463cd82f32952ba32c6c05d5cfa7cb9730b90

    • SHA256

      cc86256ed3684fb47c6f633bb1c862d7ed3ccb98b8303ddc785c063b75e2463f

    • SHA512

      dd48e26e87acb280d144d8a09d102d5479caad744958cecc6a74105e78ca310359b30343a6cb2e1cf0063ca4af30d38699aae215cf0ebac895ad04cfe956ed4b

    • SSDEEP

      12288:d3l9S58EV10F3wZa7e5QsbVcEIhqkIHq0dzSzxqx6fm2xy:d3l9w1/oeTcB7Ry

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks