General

  • Target

    JaffaCakes118_41bf6c2ff5e629dc13cd35c9bb4749a1

  • Size

    4.6MB

  • Sample

    250106-3ygcqawlap

  • MD5

    41bf6c2ff5e629dc13cd35c9bb4749a1

  • SHA1

    10cc28af90546bec4274c9ae38b0125d18177648

  • SHA256

    5c5793584de424bb7334892e62eac6a333fa52e38cdef4827fa0f451e8801693

  • SHA512

    cf3a5324c41a1668777669df0de10783100184d3cfcc3c09d80a683b24e53bf0413ad041c1968568cebb0ebe311759cee74b8c6545de5e0a10eb4167ebd5a0c1

  • SSDEEP

    98304:LLYAOeGOR1UrfOMLFsIQhlFp7CNFHKNLBce/lLOscI5TD:f7Ur/LufhlH7CNFqnXNLO7sTD

Malware Config

Extracted

Family

redline

Botnet

@PUKPUKich

C2

185.209.22.181:29234

Attributes
  • auth_value

    5a0918bd3e8ede8e02c8dd9d106a996d

Targets

    • Target

      JaffaCakes118_41bf6c2ff5e629dc13cd35c9bb4749a1

    • Size

      4.6MB

    • MD5

      41bf6c2ff5e629dc13cd35c9bb4749a1

    • SHA1

      10cc28af90546bec4274c9ae38b0125d18177648

    • SHA256

      5c5793584de424bb7334892e62eac6a333fa52e38cdef4827fa0f451e8801693

    • SHA512

      cf3a5324c41a1668777669df0de10783100184d3cfcc3c09d80a683b24e53bf0413ad041c1968568cebb0ebe311759cee74b8c6545de5e0a10eb4167ebd5a0c1

    • SSDEEP

      98304:LLYAOeGOR1UrfOMLFsIQhlFp7CNFHKNLBce/lLOscI5TD:f7Ur/LufhlH7CNFqnXNLO7sTD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks