General

  • Target

    JaffaCakes118_4e58efca0bde915039a18b545e4b5d47

  • Size

    382KB

  • Sample

    250101-khk2vssndp

  • MD5

    4e58efca0bde915039a18b545e4b5d47

  • SHA1

    b79f5ad49c5074c902babd13b44985bf07a6a8b9

  • SHA256

    5532f3699b01676915cc083ea7fcc3d5bd5b1bf0299a15ea67d0970d26ba4231

  • SHA512

    28174222e30bc064142db5ac15d2012bab34df9f9d28d5ceca5bf785e6ccdc06c911f141557604b5162a3799b10ac5088bc90858893f4837e3c3daaff74fad0d

  • SSDEEP

    6144:t8hS1XX5zUMAUVa8UaO23q/YkUv/BnBX1oz0E+Z:eE1XX5YMAUVa8UaO23q/pUv/BnBX6z0N

Malware Config

Extracted

Family

redline

Botnet

jameshook

C2

135.181.129.119:4805

Attributes
  • auth_value

    b69102cdbd4afe2d3159f88fb6dac731

Targets

    • Target

      JaffaCakes118_4e58efca0bde915039a18b545e4b5d47

    • Size

      382KB

    • MD5

      4e58efca0bde915039a18b545e4b5d47

    • SHA1

      b79f5ad49c5074c902babd13b44985bf07a6a8b9

    • SHA256

      5532f3699b01676915cc083ea7fcc3d5bd5b1bf0299a15ea67d0970d26ba4231

    • SHA512

      28174222e30bc064142db5ac15d2012bab34df9f9d28d5ceca5bf785e6ccdc06c911f141557604b5162a3799b10ac5088bc90858893f4837e3c3daaff74fad0d

    • SSDEEP

      6144:t8hS1XX5zUMAUVa8UaO23q/YkUv/BnBX1oz0E+Z:eE1XX5YMAUVa8UaO23q/pUv/BnBX6z0N

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks