General

  • Target

    JaffaCakes118_2f360a28fd68178944086d4ee3c41189

  • Size

    211KB

  • Sample

    250106-vd1xmatpcl

  • MD5

    2f360a28fd68178944086d4ee3c41189

  • SHA1

    1877bbf2a5ad37e448869b44988ca90a04bb8967

  • SHA256

    abedd6f79b229249f912becb051049586df29ead835563aa6763902d7523c2fc

  • SHA512

    528dd1402d2e0080affa317a3a3f53bc2d95ed3a5345a768b1458a51bf053682cd378b911a120a40604021d468bb316876112255b5d6637777a4a92055cb44d5

  • SSDEEP

    3072:uiZUE/UuLzakfxpxr6Zaavh1KdPLzlfIYui5U4xkwmULHBHIx:jUsfzxrofmXlfDMumUjBK

Malware Config

Extracted

Family

redline

C2

141.94.188.139:43059

Attributes
  • auth_value

    e6fd07a033474b6535552b6f7bfb4f97

Targets

    • Target

      JaffaCakes118_2f360a28fd68178944086d4ee3c41189

    • Size

      211KB

    • MD5

      2f360a28fd68178944086d4ee3c41189

    • SHA1

      1877bbf2a5ad37e448869b44988ca90a04bb8967

    • SHA256

      abedd6f79b229249f912becb051049586df29ead835563aa6763902d7523c2fc

    • SHA512

      528dd1402d2e0080affa317a3a3f53bc2d95ed3a5345a768b1458a51bf053682cd378b911a120a40604021d468bb316876112255b5d6637777a4a92055cb44d5

    • SSDEEP

      3072:uiZUE/UuLzakfxpxr6Zaavh1KdPLzlfIYui5U4xkwmULHBHIx:jUsfzxrofmXlfDMumUjBK

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks