General

  • Target

    JaffaCakes118_8e14c9d1a0d697323086c1eea23e0136

  • Size

    684.2MB

  • Sample

    241226-2kdt1atmcr

  • MD5

    8e14c9d1a0d697323086c1eea23e0136

  • SHA1

    af1d72bf2f2f7fa949d088c26258004b2a7a1f7a

  • SHA256

    ce79c219a57f3e9111e4161a2c5cdca8aefb0a8dd14dc6ff98cee19dd6129095

  • SHA512

    8dc8703dca3901f45b3ca6f3a3a6d2746588c1daf8f3f4fddc0b3a072548be38e4c5f27f031956f5004c63569568afe167c11aba6862433a625ecb34ba5e0111

  • SSDEEP

    24576:NfynywYqYD7xtR1MeHoKDmzFboJJSPZNARL:9ynkriGJSPZNAR

Malware Config

Extracted

Family

redline

Botnet

2134438635_99

C2

xsfs52.xyz:28786

Attributes
  • auth_value

    0cbe4c208edcdb775ef441547a159c7c

Targets

    • Target

      JaffaCakes118_8e14c9d1a0d697323086c1eea23e0136

    • Size

      684.2MB

    • MD5

      8e14c9d1a0d697323086c1eea23e0136

    • SHA1

      af1d72bf2f2f7fa949d088c26258004b2a7a1f7a

    • SHA256

      ce79c219a57f3e9111e4161a2c5cdca8aefb0a8dd14dc6ff98cee19dd6129095

    • SHA512

      8dc8703dca3901f45b3ca6f3a3a6d2746588c1daf8f3f4fddc0b3a072548be38e4c5f27f031956f5004c63569568afe167c11aba6862433a625ecb34ba5e0111

    • SSDEEP

      24576:NfynywYqYD7xtR1MeHoKDmzFboJJSPZNARL:9ynkriGJSPZNAR

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks