General

  • Target

    JaffaCakes118_a728a1f356831eab756ade05a19cb5d29f671260

  • Size

    725.8MB

  • Sample

    241226-wt6cqatnds

  • MD5

    4fe9998281de99dbd71b0e85fe3af02e

  • SHA1

    a728a1f356831eab756ade05a19cb5d29f671260

  • SHA256

    3160e8eeb8b613a98c0255648823590e2ef897223a6dbf4580cbc8bb3baee8df

  • SHA512

    973316f845437bd31052b609e4a99c24c4dfb9b99cb805d048b58e647b4cb99d750bcee7e55365de3dafe4996908c4207bb79815e2278bc5b72b1515bda88406

  • SSDEEP

    12288:U8AaWnPxX/J26qeHllYRqdcXUD1sEkBw2qWJiVVhYR:U8AaWlk65llYRqdeTEkBNn

Malware Config

Extracted

Family

redline

Botnet

1851281290_99

C2

194.87.71.4:3431

Attributes
  • auth_value

    e6c703f4955496a1908c64e4f8bc3bcb

Targets

    • Target

      JaffaCakes118_a728a1f356831eab756ade05a19cb5d29f671260

    • Size

      725.8MB

    • MD5

      4fe9998281de99dbd71b0e85fe3af02e

    • SHA1

      a728a1f356831eab756ade05a19cb5d29f671260

    • SHA256

      3160e8eeb8b613a98c0255648823590e2ef897223a6dbf4580cbc8bb3baee8df

    • SHA512

      973316f845437bd31052b609e4a99c24c4dfb9b99cb805d048b58e647b4cb99d750bcee7e55365de3dafe4996908c4207bb79815e2278bc5b72b1515bda88406

    • SSDEEP

      12288:U8AaWnPxX/J26qeHllYRqdcXUD1sEkBw2qWJiVVhYR:U8AaWlk65llYRqdeTEkBNn

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks