General

  • Target

    JaffaCakes118_d4ef866bb7b03f48aee87b1818b2bf410faa3aec

  • Size

    735.9MB

  • Sample

    241225-symjmaxjhr

  • MD5

    ec5ac00dced3f1d50efa51485a14e76c

  • SHA1

    d4ef866bb7b03f48aee87b1818b2bf410faa3aec

  • SHA256

    aa21c2adb1d5cfd0c7da843566b844c8a2998e0c3aec435fcfc7ed60bb98d09c

  • SHA512

    f190bfce94a1baad048c7516c70a84b1d539a529bf7134993cfc073154f411d7f11d21e0ddb73cbd56e7adc84d2118c3d5537ad23998b76f35adfb342f121657

  • SSDEEP

    24576:pcTCSSSEPZiRhkjzGna8y7iOpbyB0LlRGFSQFTOIurxkof7gkWpt/QqxN8ucb3GU:rrDbt

Malware Config

Extracted

Family

redline

C2

168.119.228.126:11552

Attributes
  • auth_value

    68893a30a30a47c75824e5062f89b53c

Targets

    • Target

      JaffaCakes118_d4ef866bb7b03f48aee87b1818b2bf410faa3aec

    • Size

      735.9MB

    • MD5

      ec5ac00dced3f1d50efa51485a14e76c

    • SHA1

      d4ef866bb7b03f48aee87b1818b2bf410faa3aec

    • SHA256

      aa21c2adb1d5cfd0c7da843566b844c8a2998e0c3aec435fcfc7ed60bb98d09c

    • SHA512

      f190bfce94a1baad048c7516c70a84b1d539a529bf7134993cfc073154f411d7f11d21e0ddb73cbd56e7adc84d2118c3d5537ad23998b76f35adfb342f121657

    • SSDEEP

      24576:pcTCSSSEPZiRhkjzGna8y7iOpbyB0LlRGFSQFTOIurxkof7gkWpt/QqxN8ucb3GU:rrDbt

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks