General

  • Target

    JaffaCakes118_c792c5df99631ba7d027cb4ffb7a61ff48120f1089881afc26e56233b912f04d

  • Size

    776.2MB

  • Sample

    241225-fr3wtaypdl

  • MD5

    77e73ed6b0ca98fdc188ac59463d77a0

  • SHA1

    22fb44eded90e8c1acf919f2d03441f154df4d49

  • SHA256

    c792c5df99631ba7d027cb4ffb7a61ff48120f1089881afc26e56233b912f04d

  • SHA512

    7c9d0b3840dcdca0d1cdbc4662ed5ccf60d0fcf28bb170dfd9b50568675f62de39f8c7fa65563bbec94caa7aa392dc2a3dd234ccf7345825f3910505136250bb

  • SSDEEP

    786432:JJCMZ7OvjGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGh:4v5

Malware Config

Extracted

Family

redline

Botnet

@killuazoldyck_off

C2

45.15.157.131:36457

Attributes
  • auth_value

    abecbb76aa6927a615d491dbbdf4e616

Targets

    • Target

      JaffaCakes118_c792c5df99631ba7d027cb4ffb7a61ff48120f1089881afc26e56233b912f04d

    • Size

      776.2MB

    • MD5

      77e73ed6b0ca98fdc188ac59463d77a0

    • SHA1

      22fb44eded90e8c1acf919f2d03441f154df4d49

    • SHA256

      c792c5df99631ba7d027cb4ffb7a61ff48120f1089881afc26e56233b912f04d

    • SHA512

      7c9d0b3840dcdca0d1cdbc4662ed5ccf60d0fcf28bb170dfd9b50568675f62de39f8c7fa65563bbec94caa7aa392dc2a3dd234ccf7345825f3910505136250bb

    • SSDEEP

      786432:JJCMZ7OvjGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGh:4v5

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks