General

  • Target

    JaffaCakes118_127a203b2df5cb4c9e21b99f3f0355df

  • Size

    517KB

  • Sample

    241231-lsgymaxkdk

  • MD5

    127a203b2df5cb4c9e21b99f3f0355df

  • SHA1

    58e1fa2a578446ed1ea46c14cc4f01f7089f4bd0

  • SHA256

    71bba7e0f9249e64b0faee6ebfa7a574cfa8f77b15212d0766e81637b5df9baa

  • SHA512

    fc0003b9ecd0c414237d6442dbcb966666a4974fa7bdbca12a7a85ce479d9972ce5d1c3cdb5e34d55bc1ae6b47cb10ee568e432aa33eba1fe4017a2ea9d28c56

  • SSDEEP

    3072:V18irYpfAMdO4J8h7P8t4fgEMMYath7t1sl59HKyf65jDZWmIbF/0M+85:b8EYpFvJ8Kt4NbhpI5syCRY1bp0M+2

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_127a203b2df5cb4c9e21b99f3f0355df

    • Size

      517KB

    • MD5

      127a203b2df5cb4c9e21b99f3f0355df

    • SHA1

      58e1fa2a578446ed1ea46c14cc4f01f7089f4bd0

    • SHA256

      71bba7e0f9249e64b0faee6ebfa7a574cfa8f77b15212d0766e81637b5df9baa

    • SHA512

      fc0003b9ecd0c414237d6442dbcb966666a4974fa7bdbca12a7a85ce479d9972ce5d1c3cdb5e34d55bc1ae6b47cb10ee568e432aa33eba1fe4017a2ea9d28c56

    • SSDEEP

      3072:V18irYpfAMdO4J8h7P8t4fgEMMYath7t1sl59HKyf65jDZWmIbF/0M+85:b8EYpFvJ8Kt4NbhpI5syCRY1bp0M+2

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks