General

  • Target

    JaffaCakes118_03dcfdf55db3e5b996047b8ba5180ae8

  • Size

    517KB

  • Sample

    250106-ar3m6aznew

  • MD5

    03dcfdf55db3e5b996047b8ba5180ae8

  • SHA1

    cfc4f440aa95a343ff85b27fb8263cc6fbbbe7f6

  • SHA256

    5ae0c2d5eb5ab0e5e7a312a311a1682badc69ee92d05f2ab5d228e2ad402d70c

  • SHA512

    9c0a48513394bed771f834ff2afc4709ab5918577f9c6065ec420e4e5a2787488ca9b894dada43ffa3cfc7eae426b113bb3fdff6147ea8d0f01d12440104e936

  • SSDEEP

    3072:C15/uPHL++1qX10RKdqM4FBI0FDmcZDGDk+xgLMczSCfZ:C15/ufL7wXy3bpFmcZSDkJBGCB

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_03dcfdf55db3e5b996047b8ba5180ae8

    • Size

      517KB

    • MD5

      03dcfdf55db3e5b996047b8ba5180ae8

    • SHA1

      cfc4f440aa95a343ff85b27fb8263cc6fbbbe7f6

    • SHA256

      5ae0c2d5eb5ab0e5e7a312a311a1682badc69ee92d05f2ab5d228e2ad402d70c

    • SHA512

      9c0a48513394bed771f834ff2afc4709ab5918577f9c6065ec420e4e5a2787488ca9b894dada43ffa3cfc7eae426b113bb3fdff6147ea8d0f01d12440104e936

    • SSDEEP

      3072:C15/uPHL++1qX10RKdqM4FBI0FDmcZDGDk+xgLMczSCfZ:C15/ufL7wXy3bpFmcZSDkJBGCB

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks