General

  • Target

    JaffaCakes118_3f029bfec11430a509701be362d7e375134b44429369cd27564ba8c2176af4e9

  • Size

    700.0MB

  • Sample

    241224-lkllvatqen

  • MD5

    c7decda57397d034d013b5536c73aeca

  • SHA1

    6e7af58436dd330acd679305a969f28612fe8709

  • SHA256

    3f029bfec11430a509701be362d7e375134b44429369cd27564ba8c2176af4e9

  • SHA512

    337ebf51beb09ebe603150e59cab6e1ed0ad9d3c0a2898885209465945745c8f52434461df0afe14284e72ec46e67a51ebe6e49baf47fba9742a9557af5e61c5

  • SSDEEP

    12288:RSnjoUaYpwPnWZQzjFeM6DJOjB9sTTHylt7cykjmh+KCqsUCWVA/L+Ad5upi2b3G:RUenYQb6VOp+dm+KCI9myb3G

Malware Config

Extracted

Family

redline

Botnet

WS-10-4

C2

38.91.100.57:32750

Attributes
  • auth_value

    dc079901931c71403af6b6f94b7d416b

Targets

    • Target

      JaffaCakes118_3f029bfec11430a509701be362d7e375134b44429369cd27564ba8c2176af4e9

    • Size

      700.0MB

    • MD5

      c7decda57397d034d013b5536c73aeca

    • SHA1

      6e7af58436dd330acd679305a969f28612fe8709

    • SHA256

      3f029bfec11430a509701be362d7e375134b44429369cd27564ba8c2176af4e9

    • SHA512

      337ebf51beb09ebe603150e59cab6e1ed0ad9d3c0a2898885209465945745c8f52434461df0afe14284e72ec46e67a51ebe6e49baf47fba9742a9557af5e61c5

    • SSDEEP

      12288:RSnjoUaYpwPnWZQzjFeM6DJOjB9sTTHylt7cykjmh+KCqsUCWVA/L+Ad5upi2b3G:RUenYQb6VOp+dm+KCI9myb3G

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks