General

  • Target

    JaffaCakes118_117817a1ca884cbf9d3fdbd33472d6f8

  • Size

    383KB

  • Sample

    250106-gbls2axnfv

  • MD5

    117817a1ca884cbf9d3fdbd33472d6f8

  • SHA1

    95ec96a8ee1c83390d8d95233c7c3bea40d3cfb3

  • SHA256

    fc807543ec130ad90ec73634dce0c085551c7d1b6ca2ba7367d25bc7d27d8654

  • SHA512

    c22cd946c992a772caf540a98c5f6cbf81525b54ae90d731e52bcf6d3897dbb034cdaf261475f3041300e9b1ccb285be6eba91ce2a1812168a3d41780a8c4661

  • SSDEEP

    6144:v9alguslU8gXYvHq1yWc3kIHz57xNoWuT9ndW4VcjmvXjMwVC:vuslU8gX4HeyWc3kMxNoWuT9ndW4Vcjt

Malware Config

Extracted

Family

redline

Botnet

KiddionsMMI_V4.51

C2

185.215.113.55:36801

Attributes
  • auth_value

    5c57f1eb36bb351b7007ba406bba7afc

Targets

    • Target

      JaffaCakes118_117817a1ca884cbf9d3fdbd33472d6f8

    • Size

      383KB

    • MD5

      117817a1ca884cbf9d3fdbd33472d6f8

    • SHA1

      95ec96a8ee1c83390d8d95233c7c3bea40d3cfb3

    • SHA256

      fc807543ec130ad90ec73634dce0c085551c7d1b6ca2ba7367d25bc7d27d8654

    • SHA512

      c22cd946c992a772caf540a98c5f6cbf81525b54ae90d731e52bcf6d3897dbb034cdaf261475f3041300e9b1ccb285be6eba91ce2a1812168a3d41780a8c4661

    • SSDEEP

      6144:v9alguslU8gXYvHq1yWc3kIHz57xNoWuT9ndW4VcjmvXjMwVC:vuslU8gX4HeyWc3kMxNoWuT9ndW4Vcjt

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks