General

  • Target

    JaffaCakes118_429813f75e48a16b433e257cf91ee9a885fe53d9c2ad2e6627e51e2cfa79719d

  • Size

    750.0MB

  • Sample

    241229-ascs5awpcz

  • MD5

    e224d5b0243ca98f833c1d18988a1398

  • SHA1

    2146591bbcfd5572aeb923bdeeaad44ce2594f56

  • SHA256

    429813f75e48a16b433e257cf91ee9a885fe53d9c2ad2e6627e51e2cfa79719d

  • SHA512

    de6678d5298a893e771481b3470b9c316b0cad62e4e6497c026ca15dbb57b9f8f7f7c1e589150db1bc0f00705fb80c99fbb8cf9807dfcf6b3215b2b9b715093a

  • SSDEEP

    6144:7NsKOejBzPPHaHpDAOHrvpmNMLEG0Rk8FSjxIqg3zpFwHls+bewu:7WKOeNPEDtp2RkkSjXIVFieh

Malware Config

Extracted

Family

redline

C2

37.220.87.13:48790

Attributes
  • auth_value

    4600169dcd362a3f56b73ff7100d93d6

Targets

    • Target

      Adobe Acrobat Reader.exe

    • Size

      750.0MB

    • MD5

      0d10e696bd976e8b85c527a47762e4a3

    • SHA1

      8b90dbdbcc47c2d1911574f93b7ff0ac45b82a64

    • SHA256

      0ff20157672c8473518e8699d508c4fc88c835ebc4d0dd42c892853cae0fac19

    • SHA512

      4dd5d2e39d20c509ee89a4ec3c2c54054eff476970f3e7d0db5b09f594cdcf244e3d8d65a526fb6851f9273c7cf78117978e5b8ee9e3074ade2a6929cc090a59

    • SSDEEP

      6144:aNsKOejBzPPHaHpDAOHrvpmNMLEG0Rk8FSjxIqg3zpFwHls+bew:aWKOeNPEDtp2RkkSjXIVFie

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks