General

  • Target

    JaffaCakes118_399121253fe8ec621f9a6a68c26c0f0b

  • Size

    4.6MB

  • Sample

    250106-zh3dgayrhl

  • MD5

    399121253fe8ec621f9a6a68c26c0f0b

  • SHA1

    260f2734e683623a729fa8eb5d4de5340cf89f86

  • SHA256

    1c669e5078fcb0f4cc4d4fe08b3eac8aef7d49cea4dc669a05af2fc4b9e8efc8

  • SHA512

    671cdda996fbf7bdded606914a7ffbd7208ac276c463312319bf3ba29d31db5d759ec4cb644863adf2c1506a03ead148e150af30b953c8b4c668af9039d68e24

  • SSDEEP

    98304:ALAR9WAXsEVfPkhz4ZJZzWEEFQVHnvnW70ckb0EMgP32fDyWdEqD7ezeaib:KAXsEVnkexKFQvWQrMgP32ryWWqD7eyN

Malware Config

Extracted

Family

redline

Botnet

716965980

C2

94.26.248.120:63731

Attributes
  • auth_value

    ee8187fd574be73a935e073f8b5705eb

Targets

    • Target

      JaffaCakes118_399121253fe8ec621f9a6a68c26c0f0b

    • Size

      4.6MB

    • MD5

      399121253fe8ec621f9a6a68c26c0f0b

    • SHA1

      260f2734e683623a729fa8eb5d4de5340cf89f86

    • SHA256

      1c669e5078fcb0f4cc4d4fe08b3eac8aef7d49cea4dc669a05af2fc4b9e8efc8

    • SHA512

      671cdda996fbf7bdded606914a7ffbd7208ac276c463312319bf3ba29d31db5d759ec4cb644863adf2c1506a03ead148e150af30b953c8b4c668af9039d68e24

    • SSDEEP

      98304:ALAR9WAXsEVfPkhz4ZJZzWEEFQVHnvnW70ckb0EMgP32fDyWdEqD7ezeaib:KAXsEVnkexKFQvWQrMgP32ryWWqD7eyN

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks