General

  • Target

    JaffaCakes118_26e36a8e3b5912a36aaec9c8b96f3e8d

  • Size

    4.6MB

  • Sample

    250106-qz7j3sxqdx

  • MD5

    26e36a8e3b5912a36aaec9c8b96f3e8d

  • SHA1

    befcd0f4999b0c2a551a47a8a0d772096f707a38

  • SHA256

    76b36353044840a1b2ef1968bcff65110fd66f182ad3781d741629fee6c8b0e7

  • SHA512

    3c4afe4d97144a718b2af3c51efe7f6fda0f08dbff3c848df0a1df5e6dc59903c71c4e5ecf70f860dc59ca43bcc659c6791172ae8028ef43b9dc75c91249ab89

  • SSDEEP

    98304:RLF/IgwvIuL/DS3uFEo1IfVEk7UA9uP+s1dKFeo36D:hc/OQEo1G3h9uP+s/Kco36

Malware Config

Extracted

Family

redline

Botnet

fs

C2

185.255.133.25:18225

Attributes
  • auth_value

    e6ae87b99bc187e67e3023b8ad515104

Targets

    • Target

      JaffaCakes118_26e36a8e3b5912a36aaec9c8b96f3e8d

    • Size

      4.6MB

    • MD5

      26e36a8e3b5912a36aaec9c8b96f3e8d

    • SHA1

      befcd0f4999b0c2a551a47a8a0d772096f707a38

    • SHA256

      76b36353044840a1b2ef1968bcff65110fd66f182ad3781d741629fee6c8b0e7

    • SHA512

      3c4afe4d97144a718b2af3c51efe7f6fda0f08dbff3c848df0a1df5e6dc59903c71c4e5ecf70f860dc59ca43bcc659c6791172ae8028ef43b9dc75c91249ab89

    • SSDEEP

      98304:RLF/IgwvIuL/DS3uFEo1IfVEk7UA9uP+s1dKFeo36D:hc/OQEo1G3h9uP+s/Kco36

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks