General

  • Target

    JaffaCakes118_358653951545a7117349ed6f1b68879e2f507893743bf60cfab02ca5ef0f5e97

  • Size

    730.4MB

  • Sample

    241225-gdbqvazjgl

  • MD5

    503cccef7fcec17a479eea3c1115e270

  • SHA1

    d7875fe335885210f5654e1d707bd0d45ea787db

  • SHA256

    358653951545a7117349ed6f1b68879e2f507893743bf60cfab02ca5ef0f5e97

  • SHA512

    f92e397b0deae194ba591e4991e2a3ee62ef838bdcde9dc6d00375dcc08a1fd491aac9becfa136d01b4e0f3803931f6386b3ae4e3027cb55ce5791a0a780150e

  • SSDEEP

    3072:GU1wcrLHEqaGRV45y8GaoUNyNd2fcLGxWU89IINIx1vmL2Afx:XUqaG8oUNCjNUi3

Malware Config

Extracted

Family

redline

Botnet

1420836138_99

C2

nanaya.uk:28786

Attributes
  • auth_value

    4aadbeb8eb384fe698f24dde846a0759

Targets

    • Target

      JaffaCakes118_358653951545a7117349ed6f1b68879e2f507893743bf60cfab02ca5ef0f5e97

    • Size

      730.4MB

    • MD5

      503cccef7fcec17a479eea3c1115e270

    • SHA1

      d7875fe335885210f5654e1d707bd0d45ea787db

    • SHA256

      358653951545a7117349ed6f1b68879e2f507893743bf60cfab02ca5ef0f5e97

    • SHA512

      f92e397b0deae194ba591e4991e2a3ee62ef838bdcde9dc6d00375dcc08a1fd491aac9becfa136d01b4e0f3803931f6386b3ae4e3027cb55ce5791a0a780150e

    • SSDEEP

      3072:GU1wcrLHEqaGRV45y8GaoUNyNd2fcLGxWU89IINIx1vmL2Afx:XUqaG8oUNCjNUi3

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks