General

  • Target

    JaffaCakes118_993a7a8d6dc703d3d1fe8c2c65dfb79a510423c203e32d22ff2ac3cd10822645

  • Size

    820.2MB

  • Sample

    241230-2ndcmssldm

  • MD5

    11ba9acca050c939b7ce6249b11cf5be

  • SHA1

    d4d9f78adcabc783b9ec6a60a54ae05796255582

  • SHA256

    993a7a8d6dc703d3d1fe8c2c65dfb79a510423c203e32d22ff2ac3cd10822645

  • SHA512

    104677b1ce5ab224a4de053a6e15b5593fd86f2e098a9e72ba06d8be583b619d079861e5252774239188db1a5d4ce2a00a52a484966dc7b6eac7bdec53a125f9

  • SSDEEP

    196608:wDdSapsb2FYXSRUTuNAPqZcrG1IniBEj+9wf6JM7w:wp

Malware Config

Extracted

Family

redline

Botnet

@Ken0zz

C2

176.113.115.24:37118

Attributes
  • auth_value

    68c1f253de2c438189ebe30588f5cf60

Targets

    • Target

      JaffaCakes118_993a7a8d6dc703d3d1fe8c2c65dfb79a510423c203e32d22ff2ac3cd10822645

    • Size

      820.2MB

    • MD5

      11ba9acca050c939b7ce6249b11cf5be

    • SHA1

      d4d9f78adcabc783b9ec6a60a54ae05796255582

    • SHA256

      993a7a8d6dc703d3d1fe8c2c65dfb79a510423c203e32d22ff2ac3cd10822645

    • SHA512

      104677b1ce5ab224a4de053a6e15b5593fd86f2e098a9e72ba06d8be583b619d079861e5252774239188db1a5d4ce2a00a52a484966dc7b6eac7bdec53a125f9

    • SSDEEP

      196608:wDdSapsb2FYXSRUTuNAPqZcrG1IniBEj+9wf6JM7w:wp

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks