General

  • Target

    JaffaCakes118_12c068b509b15f3e990221f1bc7550c5

  • Size

    1.1MB

  • Sample

    250106-gw7k8syjhz

  • MD5

    12c068b509b15f3e990221f1bc7550c5

  • SHA1

    937f2192767469a99dffeb4cf43a9515f6dc6880

  • SHA256

    d14f95ce295a474a5825e00708c71e175fa530278e5fa4f5d109fa11519c4482

  • SHA512

    9a4195166b57607c28b7167975faa94c8a71e3fe71491783521d211e63e689ec5b8b62dc08e11951b371993b7e7ba8aa8cc209d8156dfd6259c4d4e9d46265cc

  • SSDEEP

    24576:8MayWczYq6IiMYezQGcOjSCWzo+JPtssUumUbCp09N:8MaisMnzQFOjSCWzoOtsXhUbCp0

Malware Config

Extracted

Family

redline

Botnet

@YKaramelka

C2

185.209.22.181:29234

Attributes
  • auth_value

    5a0918bd3e8ede8e02c8dd9d106a996d

Targets

    • Target

      JaffaCakes118_12c068b509b15f3e990221f1bc7550c5

    • Size

      1.1MB

    • MD5

      12c068b509b15f3e990221f1bc7550c5

    • SHA1

      937f2192767469a99dffeb4cf43a9515f6dc6880

    • SHA256

      d14f95ce295a474a5825e00708c71e175fa530278e5fa4f5d109fa11519c4482

    • SHA512

      9a4195166b57607c28b7167975faa94c8a71e3fe71491783521d211e63e689ec5b8b62dc08e11951b371993b7e7ba8aa8cc209d8156dfd6259c4d4e9d46265cc

    • SSDEEP

      24576:8MayWczYq6IiMYezQGcOjSCWzo+JPtssUumUbCp09N:8MaisMnzQFOjSCWzoOtsXhUbCp0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Redline family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks