General

  • Target

    JaffaCakes118_6ea2e5ab4c31f28a058d70f1f65fdd8e92946f3f5c17c904de8d91f7703d90b1

  • Size

    741.0MB

  • Sample

    241222-p8dgxszjhk

  • MD5

    d2b65d1a7e1af37b27ac8c1fa9548e44

  • SHA1

    6901dc0ae76ab3c2735ac006404edc0add153a61

  • SHA256

    6ea2e5ab4c31f28a058d70f1f65fdd8e92946f3f5c17c904de8d91f7703d90b1

  • SHA512

    2b3745309867f2ff939bcd709fd1e7b3d8ba00a5eea8df4b23d9301d217449fe0e2f3320e47169505a32b480d0d8cb4efcd1dde0d94092342b8b209728c7596b

  • SSDEEP

    49152:38iQfZqDMZtRcSErH39j/QW9tAMw3H12QbjY:3BQfaMQrH3p/QW9uzV2Q

Malware Config

Extracted

Family

redline

Botnet

@crxnix

C2

176.113.115.7:2883

Attributes
  • auth_value

    4334b1b6304e7a30dd9472e85aa443c9

Targets

    • Target

      JaffaCakes118_6ea2e5ab4c31f28a058d70f1f65fdd8e92946f3f5c17c904de8d91f7703d90b1

    • Size

      741.0MB

    • MD5

      d2b65d1a7e1af37b27ac8c1fa9548e44

    • SHA1

      6901dc0ae76ab3c2735ac006404edc0add153a61

    • SHA256

      6ea2e5ab4c31f28a058d70f1f65fdd8e92946f3f5c17c904de8d91f7703d90b1

    • SHA512

      2b3745309867f2ff939bcd709fd1e7b3d8ba00a5eea8df4b23d9301d217449fe0e2f3320e47169505a32b480d0d8cb4efcd1dde0d94092342b8b209728c7596b

    • SSDEEP

      49152:38iQfZqDMZtRcSErH39j/QW9tAMw3H12QbjY:3BQfaMQrH3p/QW9uzV2Q

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks