General

  • Target

    JaffaCakes118_398cccb0177715258221c548689bfb3f

  • Size

    390KB

  • Sample

    250106-zhmb9axkft

  • MD5

    398cccb0177715258221c548689bfb3f

  • SHA1

    453dbc3662f99d814ce5495bac66bf6ad2b87678

  • SHA256

    407af6241572010aecdcffa172b170d72903df89abfdc388dffed5209025adb6

  • SHA512

    4a1fc5d85fbf828e5c085021c5afdb87d6b3ae68dc5f8a0aa947a300d24815a3c4675a916d0dae64e16976bce1e3169b69800e5c2c9722d2a6128e52713c88f7

  • SSDEEP

    12288:VQiVeJpgBGnc5XcwQrugxXNj8oAzJdDEWOTC7:6nJhXE

Malware Config

Extracted

Family

redline

Botnet

YTube

C2

195.2.93.155:17354

Attributes
  • auth_value

    4417d112a2503e368d8855f260c962d3

Targets

    • Target

      JaffaCakes118_398cccb0177715258221c548689bfb3f

    • Size

      390KB

    • MD5

      398cccb0177715258221c548689bfb3f

    • SHA1

      453dbc3662f99d814ce5495bac66bf6ad2b87678

    • SHA256

      407af6241572010aecdcffa172b170d72903df89abfdc388dffed5209025adb6

    • SHA512

      4a1fc5d85fbf828e5c085021c5afdb87d6b3ae68dc5f8a0aa947a300d24815a3c4675a916d0dae64e16976bce1e3169b69800e5c2c9722d2a6128e52713c88f7

    • SSDEEP

      12288:VQiVeJpgBGnc5XcwQrugxXNj8oAzJdDEWOTC7:6nJhXE

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks