General

  • Target

    JaffaCakes118_f6f7ca16cdbb499a91ee8dc15087312efc6705ce0b8ae314cc645ab2562e3566

  • Size

    750.1MB

  • Sample

    241225-ycvk1avjdx

  • MD5

    e18a08c106153108699bfd4c8eddd250

  • SHA1

    2ebb63566772c8fa7caab252c304342e5c72f89d

  • SHA256

    f6f7ca16cdbb499a91ee8dc15087312efc6705ce0b8ae314cc645ab2562e3566

  • SHA512

    bfce956538f230961fd0d60a790e8c6447872f1c6144dbef6825001938b76d42cb7399d693e46ca7a366e3bc1e593fbb9d442c05535d36061d80af151d8f7118

  • SSDEEP

    24576:e2NeoRmnEXZrpbL3reyq5MlIb8ngUqozL4QuZTdSICNIfEuQ5p3h31:e2NeoRmnEXZrpb/j7QXo/WdS

Malware Config

Extracted

Family

redline

Botnet

639820823_99

C2

194.87.71.4:3431

Attributes
  • auth_value

    59186b465ed75d9a78b750143c0dc423

Targets

    • Target

      JaffaCakes118_f6f7ca16cdbb499a91ee8dc15087312efc6705ce0b8ae314cc645ab2562e3566

    • Size

      750.1MB

    • MD5

      e18a08c106153108699bfd4c8eddd250

    • SHA1

      2ebb63566772c8fa7caab252c304342e5c72f89d

    • SHA256

      f6f7ca16cdbb499a91ee8dc15087312efc6705ce0b8ae314cc645ab2562e3566

    • SHA512

      bfce956538f230961fd0d60a790e8c6447872f1c6144dbef6825001938b76d42cb7399d693e46ca7a366e3bc1e593fbb9d442c05535d36061d80af151d8f7118

    • SSDEEP

      24576:e2NeoRmnEXZrpbL3reyq5MlIb8ngUqozL4QuZTdSICNIfEuQ5p3h31:e2NeoRmnEXZrpb/j7QXo/WdS

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks