General

  • Target

    JaffaCakes118_080d5e0df5344f34103a43c1f0e843fe4b500602

  • Size

    707.1MB

  • Sample

    241222-f64fwswkdj

  • MD5

    4f400459a47500d9d790c3dd3ee49ffe

  • SHA1

    080d5e0df5344f34103a43c1f0e843fe4b500602

  • SHA256

    75574fa51c4f64542ebfc59af5468d42a1c8cb9b60f9a4b954155f4388e5c2fa

  • SHA512

    b7d4128573294b8287f3f90c29032ca08ba3a34e563c2086b13fe91432b88718705c6ef744e342ce998088bfaf8cc93f573b78a71aa43ae4c28bae44ae88acf8

  • SSDEEP

    6144:wVn/17INOTnCoNiV+GAnmKW30z2psSOdAOC6gnTf7YZav7GY5uQY8gqs9TOXr8L3:wVn/1TTnjNiV+GUw6ggZiQQYpqf+3

Malware Config

Extracted

Family

redline

Botnet

2002149709_99

C2

nordforest.xyz:28786

bayrak.top:28786

Attributes
  • auth_value

    a2bd7a8522ba1b2edd63001da08d94d8

Targets

    • Target

      JaffaCakes118_080d5e0df5344f34103a43c1f0e843fe4b500602

    • Size

      707.1MB

    • MD5

      4f400459a47500d9d790c3dd3ee49ffe

    • SHA1

      080d5e0df5344f34103a43c1f0e843fe4b500602

    • SHA256

      75574fa51c4f64542ebfc59af5468d42a1c8cb9b60f9a4b954155f4388e5c2fa

    • SHA512

      b7d4128573294b8287f3f90c29032ca08ba3a34e563c2086b13fe91432b88718705c6ef744e342ce998088bfaf8cc93f573b78a71aa43ae4c28bae44ae88acf8

    • SSDEEP

      6144:wVn/17INOTnCoNiV+GAnmKW30z2psSOdAOC6gnTf7YZav7GY5uQY8gqs9TOXr8L3:wVn/1TTnjNiV+GUw6ggZiQQYpqf+3

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks