General

  • Target

    JaffaCakes118_193d2675d8e2636eceab7d6fc71ac8c9d6d31454d0351302de892c5c263c4969

  • Size

    886.9MB

  • Sample

    241230-wq725svlgy

  • MD5

    e91f7e2d023c56a554c788a6fc10d1f4

  • SHA1

    d1d443a8dc8a2aca7277dcba00acc7ecb9c5d9cd

  • SHA256

    193d2675d8e2636eceab7d6fc71ac8c9d6d31454d0351302de892c5c263c4969

  • SHA512

    f05992fce23b9f36a0208f9b1a6c20a1bcde842cf49eb77a51d9456f7bff05c9f75ddce9eaa4a816314f71112bca0342b8fcce8c9a05f96c6e022a2c31ef5e06

  • SSDEEP

    12288:O0wOZQAAkg586aWHffXeJy8eoSCwlCgXb5eeISr6YgalAJ85XLmcA4l:OxB5O8fuJy57DggXb5PISrdgy+85XL/

Malware Config

Extracted

Family

redline

Botnet

Naver

C2

217.160.100.70:80

Attributes
  • auth_value

    766e7b189c56b4df0a5966657eb26e9f

Targets

    • Target

      JaffaCakes118_193d2675d8e2636eceab7d6fc71ac8c9d6d31454d0351302de892c5c263c4969

    • Size

      886.9MB

    • MD5

      e91f7e2d023c56a554c788a6fc10d1f4

    • SHA1

      d1d443a8dc8a2aca7277dcba00acc7ecb9c5d9cd

    • SHA256

      193d2675d8e2636eceab7d6fc71ac8c9d6d31454d0351302de892c5c263c4969

    • SHA512

      f05992fce23b9f36a0208f9b1a6c20a1bcde842cf49eb77a51d9456f7bff05c9f75ddce9eaa4a816314f71112bca0342b8fcce8c9a05f96c6e022a2c31ef5e06

    • SSDEEP

      12288:O0wOZQAAkg586aWHffXeJy8eoSCwlCgXb5eeISr6YgalAJ85XLmcA4l:OxB5O8fuJy57DggXb5PISrdgy+85XL/

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks