General

  • Target

    JaffaCakes118_25ff4d628e88f8268dbc008635e40f8d

  • Size

    4.6MB

  • Sample

    250106-qly1saxmgy

  • MD5

    25ff4d628e88f8268dbc008635e40f8d

  • SHA1

    86e6eccc7f8c69447bc0406593eebd557524332a

  • SHA256

    48eb03a9c35f78dc2e0259b9b805f5b14e0d3aa3ad2b536d044316b3445fe216

  • SHA512

    1ef3d5be9731ad44ab5504eb4e20dc1e86882ad0e625a4c7c9080e264cc0e7161b099d6e20fec68d2d97e3b0586020fca7455df43193f9cf4e51c7c7d6b811a4

  • SSDEEP

    98304:hLcsH0pPcUEG4n+yCTvqDL8b8CEvrCYdZtpnn3tHa:APcUEdn+yMiDYYCsrtpn3la

Malware Config

Extracted

Family

redline

Botnet

@noilase

C2

92.119.113.189:21746

Attributes
  • auth_value

    de713911efa818890ac36085c9a0fc58

Targets

    • Target

      JaffaCakes118_25ff4d628e88f8268dbc008635e40f8d

    • Size

      4.6MB

    • MD5

      25ff4d628e88f8268dbc008635e40f8d

    • SHA1

      86e6eccc7f8c69447bc0406593eebd557524332a

    • SHA256

      48eb03a9c35f78dc2e0259b9b805f5b14e0d3aa3ad2b536d044316b3445fe216

    • SHA512

      1ef3d5be9731ad44ab5504eb4e20dc1e86882ad0e625a4c7c9080e264cc0e7161b099d6e20fec68d2d97e3b0586020fca7455df43193f9cf4e51c7c7d6b811a4

    • SSDEEP

      98304:hLcsH0pPcUEG4n+yCTvqDL8b8CEvrCYdZtpnn3tHa:APcUEdn+yMiDYYCsrtpn3la

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks