General

  • Target

    JaffaCakes118_197ef45c604fe013ce01b1578476fc30

  • Size

    4.6MB

  • Sample

    250106-khdmsatrbk

  • MD5

    197ef45c604fe013ce01b1578476fc30

  • SHA1

    31a0d3d434599acb177e8c11d4a1121c978477e4

  • SHA256

    c063b15b658dc5eec8a2db41186787d7ae9e55cab27dd199300423d78ef670fd

  • SHA512

    4dfd55032b48f5d4cd52d7963d37a9a355cf79f9a40a617925b47a411abac871f525fa4650101b05c047431e4f2c53e90ff1bc01502de24e0b4b4d95e51fbec7

  • SSDEEP

    98304:ULQ3NTjpEZgubqwZoB2vjjl/AWyKoDaF/x/yYZKB2+3F5cafZZ5M6mCZPwBKju:59rubi2LjKWvASxybc+1DZ591BYK

Malware Config

Extracted

Family

redline

Botnet

@F0lser

C2

5.188.118.163:80

Attributes
  • auth_value

    9bde7608ef33d6cbd8c01687cdd53196

Targets

    • Target

      JaffaCakes118_197ef45c604fe013ce01b1578476fc30

    • Size

      4.6MB

    • MD5

      197ef45c604fe013ce01b1578476fc30

    • SHA1

      31a0d3d434599acb177e8c11d4a1121c978477e4

    • SHA256

      c063b15b658dc5eec8a2db41186787d7ae9e55cab27dd199300423d78ef670fd

    • SHA512

      4dfd55032b48f5d4cd52d7963d37a9a355cf79f9a40a617925b47a411abac871f525fa4650101b05c047431e4f2c53e90ff1bc01502de24e0b4b4d95e51fbec7

    • SSDEEP

      98304:ULQ3NTjpEZgubqwZoB2vjjl/AWyKoDaF/x/yYZKB2+3F5cafZZ5M6mCZPwBKju:59rubi2LjKWvASxybc+1DZ591BYK

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks