General

  • Target

    JaffaCakes118_43d0293fea960a0df1850e8ab3455050d8fb99748e1ffd4515cb5ab008d1184c

  • Size

    1.6MB

  • Sample

    241229-abj6wawkey

  • MD5

    90b599fb5c947ff21851d32bfd8a9dcc

  • SHA1

    0b15342aeefab3e02f15ee3622572a99deb20a4f

  • SHA256

    43d0293fea960a0df1850e8ab3455050d8fb99748e1ffd4515cb5ab008d1184c

  • SHA512

    835b349f9116ceddf6deca1d0011217373ef934bda0d3a2f2256b3a28f0b7959d2c74ee830b30c5f6aa173b6d9fa3e267d7fe009c55b81019cae92ea119a744f

  • SSDEEP

    24576:kNiRZDZnb8twuRSRZN7gB0Pi4sVJyDOPPoIQm+35J+5bJZYvEAGF1EK605PX:kYF8twuc3gCJs9PMDWbJZY8ppX

Malware Config

Extracted

Family

redline

Botnet

SUBZERO

C2

185.215.113.217:19618

Attributes
  • auth_value

    019ff2a82025cde517e4466362191205

Targets

    • Target

      JaffaCakes118_43d0293fea960a0df1850e8ab3455050d8fb99748e1ffd4515cb5ab008d1184c

    • Size

      1.6MB

    • MD5

      90b599fb5c947ff21851d32bfd8a9dcc

    • SHA1

      0b15342aeefab3e02f15ee3622572a99deb20a4f

    • SHA256

      43d0293fea960a0df1850e8ab3455050d8fb99748e1ffd4515cb5ab008d1184c

    • SHA512

      835b349f9116ceddf6deca1d0011217373ef934bda0d3a2f2256b3a28f0b7959d2c74ee830b30c5f6aa173b6d9fa3e267d7fe009c55b81019cae92ea119a744f

    • SSDEEP

      24576:kNiRZDZnb8twuRSRZN7gB0Pi4sVJyDOPPoIQm+35J+5bJZYvEAGF1EK605PX:kYF8twuc3gCJs9PMDWbJZY8ppX

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks