General

  • Target

    JaffaCakes118_27f136666de992ef555d57325b537f9985c889e311ff885907fe84fd606e819d

  • Size

    715.4MB

  • Sample

    241227-ajydgawmbj

  • MD5

    a9b658122649253fbba99b78439cb435

  • SHA1

    16938d896eef3e06100faa24dd47a4f7c11306a9

  • SHA256

    27f136666de992ef555d57325b537f9985c889e311ff885907fe84fd606e819d

  • SHA512

    3898ac046e2024556e04f6af1d610f91bdb0b6eba8b637795954085bed33b8e7c4bfa2fae6feac2ec4866c5447b72eeff9ef553dbc8fe5b86fa3bf038018bf29

  • SSDEEP

    3072:NWOzZS0l2RjCCPrwoyDcb6Psnr92ZdfMKKFiRtiLc8mGPBHFj5r7fx:bLWjCCUlcOQrWPKe2cTGTl

Malware Config

Extracted

Family

redline

Botnet

607012704_99

C2

sportive.run:28786

Attributes
  • auth_value

    c34780e98b8831b21692c194755d5cb3

Targets

    • Target

      JaffaCakes118_27f136666de992ef555d57325b537f9985c889e311ff885907fe84fd606e819d

    • Size

      715.4MB

    • MD5

      a9b658122649253fbba99b78439cb435

    • SHA1

      16938d896eef3e06100faa24dd47a4f7c11306a9

    • SHA256

      27f136666de992ef555d57325b537f9985c889e311ff885907fe84fd606e819d

    • SHA512

      3898ac046e2024556e04f6af1d610f91bdb0b6eba8b637795954085bed33b8e7c4bfa2fae6feac2ec4866c5447b72eeff9ef553dbc8fe5b86fa3bf038018bf29

    • SSDEEP

      3072:NWOzZS0l2RjCCPrwoyDcb6Psnr92ZdfMKKFiRtiLc8mGPBHFj5r7fx:bLWjCCUlcOQrWPKe2cTGTl

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks