General

  • Target

    JaffaCakes118_3be046eecb8b4cbcf667ffcae447b5be3039638d1e41ccdad95795b185219f98

  • Size

    721.4MB

  • Sample

    241222-nqkmvaxjbk

  • MD5

    1eeea22e7fb6ac049baa0ef4bc304831

  • SHA1

    47e6b0373f583826540da199ea776904d3a4d179

  • SHA256

    3be046eecb8b4cbcf667ffcae447b5be3039638d1e41ccdad95795b185219f98

  • SHA512

    ad9a64bca8d1469e587b556ce3b986a78f73bc93c0ecc36049c79cb35429d525e6e9fe38e96d626e3d1544e4fa85523714018e06c635954bc85e14bdf3e3f88f

  • SSDEEP

    3072:KZjod0nQkDcnycVJQiqCyCcwgkpKqiCY8+QlTyh:Uj/hUJSvqxl

Malware Config

Extracted

Family

redline

Botnet

5527589964_99

C2

https://pastebin.com/raw/tnW31tPp

Targets

    • Target

      JaffaCakes118_3be046eecb8b4cbcf667ffcae447b5be3039638d1e41ccdad95795b185219f98

    • Size

      721.4MB

    • MD5

      1eeea22e7fb6ac049baa0ef4bc304831

    • SHA1

      47e6b0373f583826540da199ea776904d3a4d179

    • SHA256

      3be046eecb8b4cbcf667ffcae447b5be3039638d1e41ccdad95795b185219f98

    • SHA512

      ad9a64bca8d1469e587b556ce3b986a78f73bc93c0ecc36049c79cb35429d525e6e9fe38e96d626e3d1544e4fa85523714018e06c635954bc85e14bdf3e3f88f

    • SSDEEP

      3072:KZjod0nQkDcnycVJQiqCyCcwgkpKqiCY8+QlTyh:Uj/hUJSvqxl

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks