General

  • Target

    JaffaCakes118_31ab053da32c783f2b0e8284f20bf2f1

  • Size

    516KB

  • Sample

    250106-wdlclssqhx

  • MD5

    31ab053da32c783f2b0e8284f20bf2f1

  • SHA1

    b3ceb3a17b92d18a24622625220bfcec58a24d91

  • SHA256

    11e77d21c48fe22e3ae8757d06e665d051e1da30a026f80ac394daf6c0bccbd6

  • SHA512

    49c7b2150e3aa6185a0ed5963a719b6eec917237be604838b56dfbe9cafad3a94acec8a2127689a7996c2e7aa54bc082d7fbe70949c739df09a12f2c0b077677

  • SSDEEP

    3072:nO8ccmPptXdaWA5hK7BnNhPsCa3C/SOW1RfKACUSr0IpI:nOXc6tkW0K1nnMC6nRfKACUa0Iy

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_31ab053da32c783f2b0e8284f20bf2f1

    • Size

      516KB

    • MD5

      31ab053da32c783f2b0e8284f20bf2f1

    • SHA1

      b3ceb3a17b92d18a24622625220bfcec58a24d91

    • SHA256

      11e77d21c48fe22e3ae8757d06e665d051e1da30a026f80ac394daf6c0bccbd6

    • SHA512

      49c7b2150e3aa6185a0ed5963a719b6eec917237be604838b56dfbe9cafad3a94acec8a2127689a7996c2e7aa54bc082d7fbe70949c739df09a12f2c0b077677

    • SSDEEP

      3072:nO8ccmPptXdaWA5hK7BnNhPsCa3C/SOW1RfKACUSr0IpI:nOXc6tkW0K1nnMC6nRfKACUa0Iy

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks