General

  • Target

    JaffaCakes118_3b405f9bea926815349a3ca4648589de

  • Size

    4.6MB

  • Sample

    250106-z8h3hsyjaw

  • MD5

    3b405f9bea926815349a3ca4648589de

  • SHA1

    92df871596f46f95fe5750b9bc1ef332a30b9509

  • SHA256

    8b14bf1fb4731254685b264deb2cf70ae525bc0e758b393a5782dd79b6ba422c

  • SHA512

    0d7a0eb60093174408420b3a51630336f65182ea80ed02bd4bf2be18bf196caadfff77fec888ae5ab61540f920170351f3708dd79dc839e47dd186a913bdbe3f

  • SSDEEP

    98304:KLVsQ7KjJWC9/cQFNuhEpjZnThGBwTNTUGeWynzf6jSjiSh3BD6Ks:YG8C9kjh6ThGOlTyWSjt3B7

Malware Config

Extracted

Family

redline

Botnet

@iamrpx

C2

185.209.22.181:29234

Attributes
  • auth_value

    5a0918bd3e8ede8e02c8dd9d106a996d

Targets

    • Target

      JaffaCakes118_3b405f9bea926815349a3ca4648589de

    • Size

      4.6MB

    • MD5

      3b405f9bea926815349a3ca4648589de

    • SHA1

      92df871596f46f95fe5750b9bc1ef332a30b9509

    • SHA256

      8b14bf1fb4731254685b264deb2cf70ae525bc0e758b393a5782dd79b6ba422c

    • SHA512

      0d7a0eb60093174408420b3a51630336f65182ea80ed02bd4bf2be18bf196caadfff77fec888ae5ab61540f920170351f3708dd79dc839e47dd186a913bdbe3f

    • SSDEEP

      98304:KLVsQ7KjJWC9/cQFNuhEpjZnThGBwTNTUGeWynzf6jSjiSh3BD6Ks:YG8C9kjh6ThGOlTyWSjt3B7

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks