General

  • Target

    JaffaCakes118_1691aa73a0699a3be2864a407e547671

  • Size

    671KB

  • Sample

    250106-jetddszqcy

  • MD5

    1691aa73a0699a3be2864a407e547671

  • SHA1

    e3c6af09ab3708a0a4aa4dfa11a6d25a73c27a33

  • SHA256

    7feadede50c5f21b2f19d8ed73259b6f9600cafaa78923322cea911d3da0811c

  • SHA512

    f9303db80467773694ce93c1c3f97622dc20e4b5df4c7de07ed467c99befa11e0e87a85b34546ff9f51b9a3a1e707c1e7ac1f417ac9e74ae4be6a523ea1a1c54

  • SSDEEP

    3072:/s1zOpZLp7vlZwIpNUqs8W8Lz0W+DrzZ0aoPguE7Dd25Y3LloxpLrV7iOvnwWzNt:01zwP7QT8+PzCPy7fxyKhISaCF/LzY

Malware Config

Extracted

Family

redline

C2

185.215.113.51:56632

Attributes
  • auth_value

    8a057b047bb60399b5cc0fa800e50e51

Targets

    • Target

      JaffaCakes118_1691aa73a0699a3be2864a407e547671

    • Size

      671KB

    • MD5

      1691aa73a0699a3be2864a407e547671

    • SHA1

      e3c6af09ab3708a0a4aa4dfa11a6d25a73c27a33

    • SHA256

      7feadede50c5f21b2f19d8ed73259b6f9600cafaa78923322cea911d3da0811c

    • SHA512

      f9303db80467773694ce93c1c3f97622dc20e4b5df4c7de07ed467c99befa11e0e87a85b34546ff9f51b9a3a1e707c1e7ac1f417ac9e74ae4be6a523ea1a1c54

    • SSDEEP

      3072:/s1zOpZLp7vlZwIpNUqs8W8Lz0W+DrzZ0aoPguE7Dd25Y3LloxpLrV7iOvnwWzNt:01zwP7QT8+PzCPy7fxyKhISaCF/LzY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks