General

  • Target

    JaffaCakes118_3b481dc0a4049bd02790740de29fe1a5

  • Size

    170KB

  • Sample

    250106-z8yg7szqal

  • MD5

    3b481dc0a4049bd02790740de29fe1a5

  • SHA1

    2baf1b7eb8f09dcc36ecfa9555393aeb2e2849a0

  • SHA256

    7f0595e9c486adc8511f76e40c771b4fdb27d4cb6de49eaa66aa6645d364f911

  • SHA512

    64dd57cdee8bef411204190f827470aedac6467e0b68e8522304af02d44aec5b26c7b7498dde39377a086711f10fc723bc0cdc095b253e6680628f546a2f19ae

  • SSDEEP

    3072:MPk/Hi905McLeFHNrmOWnxY+USfLo6wzO3gb:NHi90MEwkYdVfzO3Q

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      JaffaCakes118_3b481dc0a4049bd02790740de29fe1a5

    • Size

      170KB

    • MD5

      3b481dc0a4049bd02790740de29fe1a5

    • SHA1

      2baf1b7eb8f09dcc36ecfa9555393aeb2e2849a0

    • SHA256

      7f0595e9c486adc8511f76e40c771b4fdb27d4cb6de49eaa66aa6645d364f911

    • SHA512

      64dd57cdee8bef411204190f827470aedac6467e0b68e8522304af02d44aec5b26c7b7498dde39377a086711f10fc723bc0cdc095b253e6680628f546a2f19ae

    • SSDEEP

      3072:MPk/Hi905McLeFHNrmOWnxY+USfLo6wzO3gb:NHi90MEwkYdVfzO3Q

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks