General

  • Target

    JaffaCakes118_0ec623a90e0056c4b478d4a53be09496

  • Size

    4.6MB

  • Sample

    250106-e74ydaymdp

  • MD5

    0ec623a90e0056c4b478d4a53be09496

  • SHA1

    1e9bcd61f458d60aa8f739938b7d184e45c24e73

  • SHA256

    dd09c7d11918a59ca5e0c7152124b781f8d5a6aaba85603e24b3a305d9445952

  • SHA512

    575f6a479bc0356cc7fc416911f7f0ac71a8a511ef8b1793c93f0d6c6b1c638d2d7e8c771c28a558c0614d5b6aaf509e8e825554503285a1aac4ec20955acda6

  • SSDEEP

    98304:/LGTG0CLGVxpKmY8m0NuX/YrxIHGbehk6Eu2:UVnKh8mEq/0Jyha

Malware Config

Extracted

Family

redline

Botnet

@usernameP1P

C2

185.209.22.181:29234

Attributes
  • auth_value

    5a0918bd3e8ede8e02c8dd9d106a996d

Targets

    • Target

      JaffaCakes118_0ec623a90e0056c4b478d4a53be09496

    • Size

      4.6MB

    • MD5

      0ec623a90e0056c4b478d4a53be09496

    • SHA1

      1e9bcd61f458d60aa8f739938b7d184e45c24e73

    • SHA256

      dd09c7d11918a59ca5e0c7152124b781f8d5a6aaba85603e24b3a305d9445952

    • SHA512

      575f6a479bc0356cc7fc416911f7f0ac71a8a511ef8b1793c93f0d6c6b1c638d2d7e8c771c28a558c0614d5b6aaf509e8e825554503285a1aac4ec20955acda6

    • SSDEEP

      98304:/LGTG0CLGVxpKmY8m0NuX/YrxIHGbehk6Eu2:UVnKh8mEq/0Jyha

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks