General

  • Target

    JaffaCakes118_18e658ec363968bf44dd6fcc8fb015a34441c346b8c196d0ae320173d48b98d0

  • Size

    906.0MB

  • Sample

    241230-g6ggss1jel

  • MD5

    4e3fcd320f3c09ce853af113918939d5

  • SHA1

    de2cb6ccbf2d91b5ffdd1091bab5ec20bb90aa2b

  • SHA256

    18e658ec363968bf44dd6fcc8fb015a34441c346b8c196d0ae320173d48b98d0

  • SHA512

    2f1cd98e4b822acacde9499b89cb0ca194eaee3deb8e1a8c1028d70811356c5ded156966b50c4aeb2489b88c2f88469fdb26a52e6f1920f8cdd38b8abc190ae7

  • SSDEEP

    98304:x0A+OS/5mKctYIWOcNZE5JJKqEDkwhrrm5jMtunv:x0A05zH

Malware Config

Extracted

Family

redline

Botnet

@aboba255

C2

94.142.138.4:80

Attributes
  • auth_value

    6487f4e00b6ec53f5fc436622f366458

Targets

    • Target

      JaffaCakes118_18e658ec363968bf44dd6fcc8fb015a34441c346b8c196d0ae320173d48b98d0

    • Size

      906.0MB

    • MD5

      4e3fcd320f3c09ce853af113918939d5

    • SHA1

      de2cb6ccbf2d91b5ffdd1091bab5ec20bb90aa2b

    • SHA256

      18e658ec363968bf44dd6fcc8fb015a34441c346b8c196d0ae320173d48b98d0

    • SHA512

      2f1cd98e4b822acacde9499b89cb0ca194eaee3deb8e1a8c1028d70811356c5ded156966b50c4aeb2489b88c2f88469fdb26a52e6f1920f8cdd38b8abc190ae7

    • SSDEEP

      98304:x0A+OS/5mKctYIWOcNZE5JJKqEDkwhrrm5jMtunv:x0A05zH

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks